I'm a developer and not much of a server admin, but am working on a project which requires me to build code which operates in a Windows 2003 domain environment, with XP client machines and so I need to setup a test environment.

I have setup a virtual server and virtual client. I did a fresh install of Windows 2003 R2 onto the server and XP SP3 onto the client. I setup the server as an Active Directory Domain Controller and DNS server. I setup a new forest and domain, then added a new Organisational Unit, created a test user account within it. Then on my client I added the machine to the domain, saw the welcome message and then proceeded to login with my test user account. All worked fine :-)

Then I had a bit of a tinker with making the account use a mandatory profile, which also went well and is working fine.

Now my problem; I need to be able to apply a restricted policy to the client account, to remove the Control Panel, My Computer, 'Run...' option and so on. I downloaded the Group Policy Management tool and then configured my Organisational Unit to have a new group policy. I then edited the policy, disabling access to a variety of things. I logged into the client but didn't see any change. No amount of trying seems to make the policy settings affect the test account. I've tried running GPUPDATE on the client, have logged out and in but nothing seems to work. Thinking my tinkering with the Mandatory Profile may have had some affect I created a new user within the same Organisational Unit, but if I login then this new account also seems to have access to the things I've restricted.

I've been reading articles and am trying to work it out, but am starting to feel a little overwhelmed by what I had expected to be a fairly simple task. Can anyone provide help me understand where I'm going wrong?

Thank you.


Is the user account for the user in the OU that you've linked the GPO to? GPO's apply to objects that are in their path (Scope of Management).

You need to move the user account to the OU, or you can link the GPO to the domain instead of the OU and leave the user account in the default Users container. Either way will work, but it's better to target the GPO to your specific user by moving the user account to the OU.

  • In the 'Active Directory Users and Computers' I see my test accounts beneath the OU, not beneath Users - so that appears to be correct. I originally created them there and so haven't had to move them at any point. – Elliveny Aug 11 '11 at 11:26
  • 1
    Are the settings you configured in the GPO user settings or computer settings? – joeqwerty Aug 11 '11 at 12:01
  • I've modified settings in both, does it make a difference to the expected result? – Elliveny Aug 11 '11 at 12:46
  • Yes, computer settings apply to the computer object and the GPO must be linked to the OU or container where the computer object is. User settings apply to the user object and the GPO must be linked to the OU or container where the user object is. – joeqwerty Aug 11 '11 at 14:18
  • Ah, that makes plenty of sense. The main things I've been looking to achieve appear in under the User settings - e.g. I set 'User Configuration -> Administrative Templates -> Control Panel -> Prohibit access to the Control Panel' to Enabled. The policy is assigned to the OU and the user is in the OU - so that seems correct and so should be applied - you agree? – Elliveny Aug 11 '11 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.