Networks·41,424 discussions

Group Policy On XP Client

Locked

I’ve got about 20 clients, some are running 2000 and some others running XP. The domain is AD Windows Server 2003.

Group policies are updating and pushing out to the Windows 2000 clients without any problems. But the XP machines won’t take any group policy changes.

I’ve done so many Microsoft KB articles that I couldn’t name them all off without going back to my logs. Everything from permissions, services on both server and clients, seems to be fine.

I need some help to get this resolved. Oh, and this is the first roleout of Server 2003 and AD for this domain so it’s never worked on XP machines.

Thanks in advance!

Topic

Clarifications

In reply to Group Policy On XP Client

Clarifications

A Few Questions

In reply to Group Policy On XP Client

Where are you applying the group policies? I mean, did you create an OU in ADU&C and apply them there or did you create the policies at the top level? It sounds like, since 2000 is working ok, that this may be a wasted question.

Are the XP machines members of the domain? (I have to ask, sorry) and what version of XP? (again, I have to ask sorry)

If you haven’t already, download this
http://www.microsoft.com/downloads/details.aspx?FamilyId=0A6D4C24-8CBD-4B35-9272-DD3CBFC81887&displaylang=en

and install it on your server. There is a section in the tool (Group Policy Modeling) that will let you test a scenario. What I usually do is on the first page, select a PC and select a user and select skip to the final page. This will let you see all settings applied and there is a place where you can see policies that were denied. This is a big help for me.

Scott

A Few Answers

In reply to A Few Questions

Thanks for the reply!

Created OUs for the departments and copied then customized GPOs for each department based on security and settings. (but even if I lock a IE URL home page in default domain policy only the 2000 machines get it)

XP Machines are members of the domain. XP Pro SP2.

I have previously downloaded and installed that MS snap-in. That’s how I did all my GPO management.

I should clarify that the default domain policy did work at the very begenning – which was about a month ago, at least, now. The XP boxes have a custom home URL that’s locked just like the 2000 boxes but when I make changes to any GPO (custom made or default domain) only 2000 clients get updated.

When I do a Group Policy Modeling query on the XP machines I get the error: An error occurred while generating report: an unknown error occurred while generating the HTML report was being created. Runs fine and no errors on 2000 clients.

GPResult

In reply to Group Policy On XP Client

You’ll want to check your event logs on the XP clients to see if you have any Group Policy related errors in there.

Also, gpresult, is a good tool to use on the XP clients to see which Group Policies applied to the machine. You can pipe the output to a file to make it easier to read. Just drop to a command line and run:

gpresult > gpresult.txt

Take a look at that and see if you see anything in there that might shed some light on your issue.

Jack Doyle, Systems Engineer
ScriptLogic Corporation
http://www.scriptlogic.com

GPResult Results

In reply to GPResult

Thanks for the suggestion. GPResults on the three XP clients that I tested showed that all group policies that should run were – both computer and user. It also did the correct group policies and says a current date/time when it was last applied.

… but the things the GPO is supposed to do isn’t happening on the machines.

It almost looks like the computer GPO parts are working on XP machines but not user. Does that make any sense?

A Few Stupid Questions

In reply to GPResult Results

the policies your pushing that are not working: Are they user policies or computer policies? Where are your users located in your AD? It sounds like your computer related policies are received by the clients but the user policies are not. Are your users logging in with local accounts or domain accounts?

Local rights

In reply to Group Policy On XP Client

Hi Yall,
I have seen this occur a few times and the only thing i could come up with was to give the domain user local rights. So on the local machine find the user in the advanced user settings and give it local admin rights …..

[Author]

Replies