2

My situation is as follows:

  • I have 1 Windows Server 2016 as Domain Controller which provides policies (DC1).
  • I have 1 Windows Server 2016 as Terminal server (RD1).
  • I have multiple PC's

All are joined to the domain.

I have set network share access using policies with the Replace option.

My problem is: Every 90 or so minutes, Background policies are executed, and as such the share policy refreshes the share, which means, remove share, recreate.

Any program using a file on the share suddenly can't find the file for a brief moment. For example VLC Media player will crash, Visual Studio will say the project was modified from the outside and asks if I want to reload it.

I know I can change the replace to update or another method, but I want to be able to remove the share simply by removing a user from the usergroup attached to that share.

In order to combat this, I changed the group policy to not do background sync of policies, which is a computer policy and requires a restart. But after a restart, it still syncs every 90 minutes. I then changed the sync interval to the maximum of 31 days (yes, it used to be 45), restarted, still syncing every 90 minutes. There's even a policy I found that doesn't refresh policies unless the policy object itself has changed. Again, this has no effect.

I did a gpresult /v and saw that the policies mentioned above are not even listed.

I have added the computer to the policy and gave it read permissions, similar to how other groups are listed, but that yielded no result either.

I suppose I could setup this using local group policies, but before I go this route, I'd like to make it possible to setup this through domain group policies.

Anyone an idea why this isn't working, and how to fix it?

Improve this question
4
  • A good solution that I've used to avoid background syncing and still being able to remove old settings is to create a "Reversal" policy, where I apply "reverse" configurations or "Delete/Remove" on policies like mapped drives and printers.
    – Jonathon Anderson
    Oct 20, 2017 at 14:54
  • @NonSecwitter well, that would imply that I create a policy that removes them, and disable them. The problem is that if I have a policy to remove drives, and then update them, its identical to replace, and as such, the background update also removes the drive and recreates it. Maybe I can combine that with apply only once. I haven't tried that.
    – LPChip
    Oct 20, 2017 at 21:44
  • Sorry, I mean that you only apply the remove policy when you no longer need the setting, as your goal is to be able to instantly remove the share. If you are using item level targeting and user groups, you could just move them from one group to another, say from "M Drive" to "M Drive Removal"
    – Jonathon Anderson
    Oct 23, 2017 at 14:19
  • @NonSecwitter, that would mean I have to wait for them to login, and then remove the group once more, which I can forget. Its a good workaround, but getting this policy to work is so much better. :)
    – LPChip
    Oct 23, 2017 at 14:47

1 Answer 1

Reset to default
1

I found out what my problem was. The policy was not placed at the highest level and therefor was still skipped, even though I added the group. After creating a new link at the highest level, set it enforced, then removing the old one, a gpupdate /force now updates.

The gpresults /v now actually shows me the policies I have set.

Improve this answer
4
  • You could simply set the "Apply Once" option on the Common tab of the GPP item. That applies the GPP setting at user logon and not at the GP refresh interval.
    – joeqwerty
    Oct 20, 2017 at 14:56
  • @joeqwerty that was the very first thing I did, but with replace, that is grayed out/not allowed.
    – LPChip
    Oct 20, 2017 at 21:42
  • It is allowed with Replace but not when you have the option Remove this item when it is no longer applied enabled.
    – joeqwerty
    Oct 20, 2017 at 22:01
  • @joeqwerty ah right. But that's exactly what I want to achieve, it being removed when I remove the user from the group.
    – LPChip
    Oct 20, 2017 at 22:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .