I have a working policy on my entire domain. I just found out, when logging with the domain administrator, that this policy is not applied (EDIT: Running : gpresult shows that the GPO's are applied - but, this GPO is for Drive Mappings, and the actual drive mappings are NOT shown)

  • The administrator account - does not have any login script on his profile tab.
  • To note: The mappings were applied before the GPO with a login script using the : net use ... command - all was working perfectly and correctly for the domain administrator user as well - That removes sharing and security problem (IMO)

  • My GPO's are mainly small/atomic settings: single GPO to handle each settings: UAC, Firewall, printers.

  • GPO status for the object is enabled

That's an overview of the Drive Maps:

enter image description here

Reading on MS support site, I checked the delegation tab, and it is marked as applied to domain and enterprise admins.

enter image description here

Every user gets these policies correctly.

The OU that is set is the root of the domain. (for testing purpose - I did that to eliminate hierarchy issues - did not help)

  • Block Inheritance is disabled. (never used it anyway)

GPO link

enter image description here

GPO Security Filterings

enter image description here

  • Does the OU that the Administrator account is currently located in have 'Block Inheritance' enabled? Sep 25, 2012 at 7:46
  • Domain forest? Do you mean the domain root? You can't block inheritance at the forest root. Anyway, where is the Administrator account - is it in a sub-OU of the domain or just in the default Users container? Sep 25, 2012 at 8:03
  • Just the default container
    – Saariko
    Sep 25, 2012 at 8:04
  • Ah, just seen your response - GPOs applied at the root of the domain should apply to users in the Users container, in the same way as it would for any other OUs. Is the GPO definitely linked at the Domain root level? Sep 25, 2012 at 8:04
  • Also, what is in the Security Filtering options of the GPO? Sep 25, 2012 at 8:06

1 Answer 1


I suspect you are falling foul of the fact that Domain Admins are part of a special set of groups that have their ACLs reset every hour by the domain controller.

See http://support.microsoft.com/default.aspx?scid=kb;en-us;Q318180 for more details

  • That KB article is related to membership of Distribution Groups. Moreover, it applies to Server 2000, not 2008. Sep 25, 2012 at 9:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .