0

There is a small network on a domain. Not too long ago a new machine was added. The OU that the user is linked to was part of an OU that is, among other things, not allowed to change desktop background. However, come to find out, the new computer user was able to change their background.

Unsurprisingly, this caused much angst among co-workers, so I worked furiously to correct the problem. I even went so far as to create a shiny new bg for everyone to use.

I went in and edited the policy for this OU to reflect the new settings. Upon running gpupdate and checking gpresult on the computer, a reboot led to the shiny new bg as expected. I did the same on another users computer (who had also managed to change their BG), but this time upon reboot, I was still met with their thumbnail sized bg staring at me.

After some time on that machine fiddling with registry settings and whatnot, I finally got into gpedit as admin and manually set the BG (I could NOT get rid of the background otherwise; had locked myself out of changing it via GP). Once the old one was gone, I went back in and reset the local gp desktop bg setting as not set. Rebooted, and the background was there as set in OU GP.

Today, though, I come in and the new computer is back to the BG they set before this all exploded. I run through RSOP on that user, and all checks out.

How could this computer not be complying with the OU GP? Am I missing a setting or something that allows (old) local policy to supersede the OU policy?

1 Answer 1

0

I'm betting that if you enable "Prevent Changing Desktop Background" in the GPO, you'll be set. That setting can be found in User Configuration -> Policies -> Admin templates -> Control Panel -> Personalization -> Prevent Changing Desktop Background. If you pair this with setting the wallpaper remotely via the "Desktop Wallpaper" setting (in User Configuration -> Policies -> Admin Templates -> Desktop -> Desktop), users should be locked into the wallpaper you choose. I don't know if themes that include backgrounds can get around that restriction, but if they can, you should also enable "Prevent Changing Theme", in the same place as "Prevent Changing desktop Background".

If that doesn't work, there are a couple of (much less likely, and probably insane) possible solutions:

I know Active Desktop is an old technology, but if your workstations are running XP or older, try this: Make sure that you have "Prohibit Changes" enabled in the GPO that is changing the wallpaper; The setting is in the same policy group as the "Desktop Wallpaper" setting: in User Configuration -> Policies -> Admin Templates -> Desktop -> Desktop -> Prohibit Changes. Make sure that "Enable Active Desktop" (same place) is enabled, as well.

Also, since Desktop Background is a per-user setting, make sure that you are applying the GPO to specific user accounts; not just workstations. This almost certainly makes no difference, as it should work on computer objects just as well as users, but try it just to be on the safe side.

3
  • Thanks. But, those are all already set (the prevent changing etc.; they've been set for a while) and these settings are applied to the OU user group; the computer GP settings don't have the same settings as user (e.g. desktop), so that's all set. What's happening is that on this machine, for some reason, the local policy is overriding the Group Policy somehow.
    – stormdrain
    Dec 29, 2011 at 16:52
  • Sorry, should have read your question more thoroughly. If you want a detailed log of what's applying what on the workstation, try environment logging: support.microsoft.com/kb/221833/en-us. Also, I still would make sure that it's not a GPO scope issue. The easiest way to eliminate scope as a possible cause is: try moving the desktop background settings GPO up to the same level as your default domain GPO, and just set a security filter that only applies it to the users/computers that you want to be affected. If the problem vanishes, it was a scope issue. If it doesn't, I'm stumped.
    – Zac B
    Dec 29, 2011 at 17:21
  • Yeah, I can't tell what is going on. It's now happening on another machine again. I don't see any scope issues; there's only 1 policy that is going out (besides default domain policy). But when I run gpresult on the machines, I don't see the Desktop wallpaper setting in the results. I see a bunch of other template settings, but not the wallpaper. I have to manually go into the machines gpedit and set the wallpaper there to get rid of the ridiculous new years wallpapers they set...
    – stormdrain
    Dec 30, 2011 at 13:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .