2

I have an OU named "Asia" wherein I've set regional settings via a GPO named "Asian Settings." This GPO is linked to the "Asia" OU and the link is enabled. However, when I run gpresult the log indicates that the "Asian Settings" GPO was NOT applied nor was it filtered out. I've tried gpupdate but that didn't resolve the problem. Can anyone explain why the GPO is not being applied to the OU and what I need to do in order to have it applied?

9
  • Is there anything in the OU? What regional settings have you configured?
    – joeqwerty
    May 27, 2011 at 15:27
  • @joeqwerty: There are user objects in the OU. Via an ADM file I configured settings for counrty name, datetime, currency, etc.
    – Ari
    May 27, 2011 at 15:33
  • 1
    And the ADM file you created configures User settings and not Computer settings, right? Are you logging on as one of the users in the OU?
    – joeqwerty
    May 27, 2011 at 15:34
  • @joeqwerty: Yes, the ADM file configures user settings (and not computer settings) Well, when I run the gpresult command I'm logged in as the administrator. But otherwise I do login as a member of the target OU.
    – Ari
    May 27, 2011 at 15:40
  • 1
    Double check the linked GPO's and GPO inheritance for the Asia OU and run gpresults again for an Asia OU user and check both the Applied and Denied GPO's again. Also, is the security filtering of the GPO set to Authenticated Users?
    – joeqwerty
    May 27, 2011 at 15:52

2 Answers 2

3

With loopback processing enabled (in replace mode) it tells the GPO CSE's to process and apply the user settings defined in the GPO linked to the TS OU instead of processing the user settings defined in the GPO linked to the user OU (Asia). I suspect the loopback setting is configured to replace the user settings and not merge the user settings.

In addition, setting the loopback policy to merge mode would process and apply the user settings from both the computer and the user OU's.

14
  • 1
    Just from "TS Policy" - Good find. May 27, 2011 at 16:45
  • @joeqwerty: I re-configured the loopback policy to merge from replace, but it didn't resolve the issue. When I look in the applied GPO section of the user configuration summary I see that only the Default Domain Policy and TS Policy are applied. Could the problem be with the ADM file?
    – Ari
    May 27, 2011 at 16:55
  • @joeqwerty: I also tried disabling the loopback all together, but that didn't solve the problem either.
    – Ari
    May 27, 2011 at 17:06
  • 2
    Run gpupdate /force on the server. Even if the ADM is borked you should still see the GPO being applied. Also note that in replace mode the user GPO's don't get processed and won't be listed in gpresults but in merge mode they do get processed and should be listed in gpresults. Also, when using merge mode the user settings configured in the GPO linked to the computer OU take precedence, so if you have the same setting in both sets of user configurations (computer OU GPO and user OU GPO), the computer GPO settings would take precedence.
    – joeqwerty
    May 27, 2011 at 17:11
  • 1
    That's weird but I'm glad it's working for you now.
    – joeqwerty
    Jun 5, 2011 at 17:24
0

Did you try gpupdate /force, or just gpupdate? If the latter, it may not happen right away. The default wait time on gpupdate is 600 seconds or 10 minutes.

1
  • I used gpupdate /force.
    – Ari
    May 27, 2011 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.