Networks

Ask something
Question Locked

Group policy block inheritance not working

0 helpful
6 replies

by david__

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hello all,
I am experimenting with terminal server and thin clients.
I have an OU setup with the terminal server in it and restrictive policies setup with loopback set on the policy.
The problem is that even when I login as an admin it loopbacks...like it is supposed to. So I created a sub OU in the OU with the terminal server and set that OU to block inheritance and put the admin account created to manage the terminal server in it. It does not block the policy, it still gets applied. I even had a policy to counter the restrictive policy and applied it to the OU with the admin account in it. That did not work either.

Please help. TIA.

6 replies

by wancona

Have you tried enforcing the GPO. You can also,try using WMI filtering where you remove the administrator account out of the group that it is being applied to.

Don't forget also that it takes a little while for the group policy to refresh on the client computers, so what you can do is, from the client computer, go to the command line and type gpupdate /force. this will force the group policy to update, as the name says

by david__

I have tried using enforcement. Also, I did use the gpupdate /force to update the policy.

I have not tried the WMI filter. I know what it is supposed to do, but dont know how to make the code to do it. Any help with WMI filter to exclude the admin account would be great.
TIA

by wancona

Changing the Security permissions on policies is one of the best kept secrets of Group Policies. Microsoft call it 'filtering' the policy so it only applies to certain users. The default setting is 'Authenticated Users' Apply Group Policy.

A question: is the Administrator an 'Authenticated User'? Of course he is. This is how enthusiastic policy setters lock themselves by applying severe policies at the Domain level and forgetting that they are an authenticated User'.

The secret is to remove 'Authenticated User' and add the groups you actually want the policy to affect.

Also, try this link:

http://support.microsoft.com/kb/260370/en-us

by david__

Thanks so much. Removing the authenticated users group and adding my own fixed it.

Thanks again

This discussion is closed to new replies.