Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Let me start by saying that my experience with GPO is limited to tentatively poking at settings until they fall into place by trial and error. It is entirely possible this will be a very obvious answer.

Our goal is to keep three computers off the internet, without limiting their access to the local network.

The person I am replacing had set up a GPO called "Internet Lockdown" with the following layout (in italics=added by me):

SCOPE:

Links: No Internet (this is an OU that is a child of our main SBSComputers OU and has the targeted computers as members). Not Enforced. Link Enabled.

Security Filtering:

  • Authenticated Users
  • computer1
  • computer2
  • computer3

No WMI Filter

DETAILS

GPO Status: Computer Configuration Settings Disabled (Enabled)

SETTINGS

Computer Configuration/policies/administative templates/system/group policy

User group policy loopback processing mode: Enabled

Mode: Replace

User Configuration/Windows Settings/Internet Explorer Maintenance/Connection/Proxy Settings

Enable proxy settings: All to 127.0.0.1:4664

Except beginning with 192.168.1.200 or intranet

Administrative Templates/Windows Components/Internet Explorer

Disable changing automatic configuration settings:enabled

disable changing connection settings:enabled

disable changing proxy settings: enabled

disable internet connection wizard:enabled

/browser menu

Tools Menu: Disable Internet Options... menu option:enabled

I've done gpupdate /force on both the DC and the target computers, but, although other GPO's run fine, this one seems to be ignored. Some initial googling led me to adding the loopback processing mode to computer configuration and then enabling the computer configuration option, I also thought I might need the specific computer objects in the security filtering section but these have made no change. I am not logging onto the target computers with my domain admin account.

When I run gpresult /h result.html I see that in Computer configuration/Group Policy Objects/Denied GPOs Internet Lockdown is listed with the reason "Disabled GPO". This confuses me, because it is all enabled now. It also doesn't show up anywhere under user configuration, neither applied nor denied.

Event logs contain nothing useful beyond the time it processed GP on either DC or the target computers.

Any thoughts?

share|improve this question

migrated from superuser.com Apr 19 '13 at 4:03

This question came from our site for computer enthusiasts and power users.

1 Answer 1

It's because you have Computer Settings Disabled configured. Try changing that dropdown to just plain Enabled and try that.

With that said, you're configuring both Computer Policies and User Policies in one GPO. Technically, there's nothing wrong with this but it is considered bad practice and makes troubleshooting difficult.

It also makes a mess of your security filtering. For example, in your instance, having the computers listed makes no difference whatsoever because you have Authenticated Users listed.

I'd suggesting splitting your policies into two - one containing all of the Computer Configuration items and one containing all of the User Configuration items. If you want both sets of GPO's to apply to all computers in that OU (And therefore all users that logon to them) then just leave both sets of Security Filtering to Authenticated Users. (Though bear in mind it'll apply to administrators, too)

share|improve this answer
    
Sorry, this may not be clear enough in the question but the drop down is already set to enabled. Also I am not really looking to set both computer AND user settings here I am looking to set User configuration on a per machine basis - that is, all user's using a machine targeted by this GPO should be affected by the contained user configuration. It was my understanding that this was the point of the loopback policy and that's the only included computer configuration. Can youi suggest a way I would apply this user configuration on a machine basis using only either computer or user settings? –  Chris O'Kelly Apr 21 '13 at 21:28
    
You're on the right lines with what loopback policies do - all I'm saying is you should create a new GPO to configure the Computer Configuration (The loopback settings in this case) and then just have your other one doing the `User Configuration. –  Dan Apr 22 '13 at 8:18
    
is this a "being neat" suggestion or a possible cause for the issue? I've tried splitting the policy out and the issue is unchanged. –  Chris O'Kelly Apr 22 '13 at 21:31
    
@ChrisO'Kelly Not really, no, but I was finding it very difficult to follow what's happening. Perhaps you could post up some screenshots of everything? You should also try out the results and modelling tools again. –  Dan Apr 23 '13 at 7:48
    
Also keep in mind that loopback processing mode is a per-computer setting as opposed to per-GPO. That mean that once you enable it in one GPO that applies to a computer, all user policy GPO settings in all GPO's that touch that computer will apply to all users who log into those computers. I believe that is part of why @Dan is recommending you separate the two. –  charleswj81 Apr 27 '13 at 0:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.