Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I manage quite a few AD networks for clients, all SME sizes and have done this since the w2k days. At one of them I've just seen something I cannot explain at all.

We have two policies defined for WSUS, one for servers one for client PCs. The server policy is applied to the sub sub OU for servers and the client policy is applied to the sub sub OU for PCs. Neither is applied in any other part of the AD tree. Pretty simple.

We had a problem with WSUS on the servers which was caused by both policies being applied to some (maybe all - I didn't check) of the servers.

Opening the client PC policy, the tab which indicates where it is being used showed only the OU containing PCs... so no mistakes with applying it to the root or anything similar.

I picked one server and concentrated on that to try and work out why the client PC policy and server policy were both being applied to it (according to gpresult /d)

gpupdate /f made no difference, neither did rebooting.

I tried creating a new OU and moving the server to it. The result (after a gpupdate) was that the server policy disappeared from gpresult as expected, but the client pc policy continued to be applied.

I edited and renamed the client pc policy just to make sure I wasn't mistaken and to refresh the policy - no effect.

I tried a few more things over the course of a couple of hours but In the end I had to delete the policy to stop it from being applied. It was a simple policy so this was faster, but now my curiosity has been piqued.

How on earth could this policy have been applied to several nodes without it appearing in the appropriate OU tree in the GPO editor? A bug seems unlikely, so there has to be some functionality there that I've never noticed.

All machines involved are running win2008r2, the dcs included.

share|improve this question
What does gpresult /h show you on a misbehaving machine? It should, hopefully, shed some light. – MDMarra Oct 24 '12 at 23:15
It doesn't sound like it based on what you've stated that you checked, but is it possible that this GPO was linked to the AD Site and not to the AD Domain or OU? – joeqwerty Oct 24 '12 at 23:58
@mdmarra wish I'd tried that as it shows the link point for the policy, which is what I was trying to work out. thanks for the pointer - I've been rather glued to my habit of just using text only. – Ian Oct 25 '12 at 8:51
@joeqwerty hadn't realised you could link to a site, but no, this is not something I've ever done on any client by linking from a sites node, so I don't think it could have been that. – Ian Oct 25 '12 at 8:51

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.