I have a working policy on my entire domain. I just found out, when logging with the domain administrator, that this policy is not applied (EDIT: Running : gpresult shows that the GPO's are applied - but, this GPO is for Drive Mappings, and the actual drive mappings are NOT shown)

  • The administrator account - does not have any login script on his profile tab.
  • To note: The mappings were applied before the GPO with a login script using the : net use ... command - all was working perfectly and correctly for the domain administrator user as well - That removes sharing and security problem (IMO)

  • My GPO's are mainly small/atomic settings: single GPO to handle each settings: UAC, Firewall, printers.

  • GPO status for the object is enabled

That's an overview of the Drive Maps:

enter image description here

Reading on MS support site, I checked the delegation tab, and it is marked as applied to domain and enterprise admins.

enter image description here

Every user gets these policies correctly.

The OU that is set is the root of the domain. (for testing purpose - I did that to eliminate hierarchy issues - did not help)

  • Block Inheritance is disabled. (never used it anyway)

GPO link

enter image description here

GPO Security Filterings

enter image description here

  • Does the OU that the Administrator account is currently located in have 'Block Inheritance' enabled? – Chris McKeown Sep 25 '12 at 7:46
  • Domain forest? Do you mean the domain root? You can't block inheritance at the forest root. Anyway, where is the Administrator account - is it in a sub-OU of the domain or just in the default Users container? – Chris McKeown Sep 25 '12 at 8:03
  • Just the default container – Saariko Sep 25 '12 at 8:04
  • Ah, just seen your response - GPOs applied at the root of the domain should apply to users in the Users container, in the same way as it would for any other OUs. Is the GPO definitely linked at the Domain root level? – Chris McKeown Sep 25 '12 at 8:04
  • Also, what is in the Security Filtering options of the GPO? – Chris McKeown Sep 25 '12 at 8:06

I suspect you are falling foul of the fact that Domain Admins are part of a special set of groups that have their ACLs reset every hour by the domain controller.

See http://support.microsoft.com/default.aspx?scid=kb;en-us;Q318180 for more details

  • That KB article is related to membership of Distribution Groups. Moreover, it applies to Server 2000, not 2008. – Chris McKeown Sep 25 '12 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.