0

Let me start by saying that my experience with GPO is limited to tentatively poking at settings until they fall into place by trial and error. It is entirely possible this will be a very obvious answer.

Our goal is to keep three computers off the internet, without limiting their access to the local network.

The person I am replacing had set up a GPO called "Internet Lockdown" with the following layout (in italics=added by me):

SCOPE:

Links: No Internet (this is an OU that is a child of our main SBSComputers OU and has the targeted computers as members). Not Enforced. Link Enabled.

Security Filtering:

  • Authenticated Users
  • computer1
  • computer2
  • computer3

No WMI Filter

DETAILS

GPO Status: Computer Configuration Settings Disabled (Enabled)

SETTINGS

Computer Configuration/policies/administative templates/system/group policy

User group policy loopback processing mode: Enabled

Mode: Replace

User Configuration/Windows Settings/Internet Explorer Maintenance/Connection/Proxy Settings

Enable proxy settings: All to 127.0.0.1:4664

Except beginning with 192.168.1.200 or intranet

Administrative Templates/Windows Components/Internet Explorer

Disable changing automatic configuration settings:enabled

disable changing connection settings:enabled

disable changing proxy settings: enabled

disable internet connection wizard:enabled

/browser menu

Tools Menu: Disable Internet Options... menu option:enabled

I've done gpupdate /force on both the DC and the target computers, but, although other GPO's run fine, this one seems to be ignored. Some initial googling led me to adding the loopback processing mode to computer configuration and then enabling the computer configuration option, I also thought I might need the specific computer objects in the security filtering section but these have made no change. I am not logging onto the target computers with my domain admin account.

When I run gpresult /h result.html I see that in Computer configuration/Group Policy Objects/Denied GPOs Internet Lockdown is listed with the reason "Disabled GPO". This confuses me, because it is all enabled now. It also doesn't show up anywhere under user configuration, neither applied nor denied.

Event logs contain nothing useful beyond the time it processed GP on either DC or the target computers.

Any thoughts?

0

1 Answer 1

1

It's because you have Computer Settings Disabled configured. Try changing that dropdown to just plain Enabled and try that.

With that said, you're configuring both Computer Policies and User Policies in one GPO. Technically, there's nothing wrong with this but it is considered bad practice and makes troubleshooting difficult.

It also makes a mess of your security filtering. For example, in your instance, having the computers listed makes no difference whatsoever because you have Authenticated Users listed.

I'd suggesting splitting your policies into two - one containing all of the Computer Configuration items and one containing all of the User Configuration items. If you want both sets of GPO's to apply to all computers in that OU (And therefore all users that logon to them) then just leave both sets of Security Filtering to Authenticated Users. (Though bear in mind it'll apply to administrators, too)

5
  • Sorry, this may not be clear enough in the question but the drop down is already set to enabled. Also I am not really looking to set both computer AND user settings here I am looking to set User configuration on a per machine basis - that is, all user's using a machine targeted by this GPO should be affected by the contained user configuration. It was my understanding that this was the point of the loopback policy and that's the only included computer configuration. Can youi suggest a way I would apply this user configuration on a machine basis using only either computer or user settings? Apr 21, 2013 at 21:28
  • 1
    You're on the right lines with what loopback policies do - all I'm saying is you should create a new GPO to configure the Computer Configuration (The loopback settings in this case) and then just have your other one doing the `User Configuration.
    – Dan
    Apr 22, 2013 at 8:18
  • is this a "being neat" suggestion or a possible cause for the issue? I've tried splitting the policy out and the issue is unchanged. Apr 22, 2013 at 21:31
  • @ChrisO'Kelly Not really, no, but I was finding it very difficult to follow what's happening. Perhaps you could post up some screenshots of everything? You should also try out the results and modelling tools again.
    – Dan
    Apr 23, 2013 at 7:48
  • 1
    Also keep in mind that loopback processing mode is a per-computer setting as opposed to per-GPO. That mean that once you enable it in one GPO that applies to a computer, all user policy GPO settings in all GPO's that touch that computer will apply to all users who log into those computers. I believe that is part of why @Dan is recommending you separate the two. Apr 27, 2013 at 0:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .