Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Server: Windows Server 2008 R2 x64 Enterprise; Installed and tested roles: AD(PDC), DNS, DHCP

Joined client: Windows XP sp2 professional; Installed updates:Group Policy Preference Client Side Extensions for Windows XP;XMLLite for Windows XP

I created an ou in AD(ou-clients) and put above client into it;then I opened gpo and created a gpo object and linked it to the above ou(ou-clients) path in Group Policy Management(not Enforced);I changed nothing in the other gpo objects(Default Domain Policy, Default Domain Controllers Policy);

The problem is that some settings applies to the client and some not!!!???

for example: Applied (I saw the result on the client): Do not require ctrl+alt+delete

Not effective: Prevent changing desktop background (User Configuration\Administrative Templates\Control Panel\Personalization)

I run gpupdate /force on the client with admin credentials; not effective yet; I restart the client several times; not effective; I logged in with different user credentials; not effective;

any idea why this setting doesn't apply???

share|improve this question
    
on the client... logged in as a user that you want this to apply to, run gpresult /r (or just gpresult) and see which policies are being applied –  SpacemanSpiff Aug 9 '12 at 22:13
    
gun gpresult /h C:\results.htm on one of the computers who's policy didn't enforce - that may provide you with some clues –  DKNUCKLES Aug 9 '12 at 23:56
    
It seems that everything is fine with gpresult; my gpo(gpo1) did applied to the computer settings but in the User Settings section, I can't see my gpo(gpo1) in applied policy section: it says N/A(although i logged in as one of the users that my gpo can apply to (Authenticated Users)) –  ayyob khademi Aug 10 '12 at 9:45

1 Answer 1

I finally found the reason that prevent my setting (Prevent changing desktop background) to be applied;

First is that you should add appropriate groups in the Security Filtering section; if you'r settings are part of Computer Configuration section of the Group Policy Management Editor, then you should add for example Domain Computers (or any group that contain you'r desired computers) in the Security Filtering section; And same for the Users Configuration section of the Group Policy Management Editor;

Second is that when you are editing a gpo that Security Filtered with domain computers, you should just modify the settings in the Computer Configuration section of the Group Policy Management Editor, and when editing a gpo that Security Filtered with domain users, then you should just modify the settings in the Users Configuration section of the Group Policy Management Editor.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.