Windows Forum

Ask something
Discussion Locked

Group Policy Inheritance problem

0 helpful
6 replies

by 5jgibbs 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Ok, I set up a GP on a OU called nhart_high. Restricting all software under user configuration ect?. . And then I allowed the path %systemroot%\system32\calc.exe to be unlocked. So when I do resultant set of policies, I get a list, and it all checks out. Everything looks fine, I log in as a basic user, no special privileges or anything, and then..

NOTHING IS RESTRICTED!!.. I have made the policy ?no override? .. there is no override on the DC policy so that would not set the OU off. I have tried it 100 times now, with no luck

Thanks

Jeremy

6 replies

by bfilmfan

The Default Domain controller policy only is applied to the domain controllers. Check the default domain policy's settings.

In addition, as both the computer and user accounts lockated in the OU that you created?

Also, did you reapply the GPO to the system? Depending on the workstation OS, this command varies, but would be:

Windows XP:
Open a command prompt and input the command gpupdate /force.

Windows 2000:
Open a command prompt and inpute the command secedit /refreshpolicy machine_policy followed by the command secedit /refreshpolicy user_policy.

by cg it

uncheck the no override box then do an immediate GP refresh. Then try.

If that also fails, tell us where you created the OU [AD users and computers?] tell us how you created the GPO, tell us what groups of users or computers you collected in the OU. Finally, make sure the user your logging in on is a member of the group you assigned to the OU.

by cg it

no override is supposed to enforce the policy on the container [OU] regardless of policy inheritance from a parent. for the policy to have effect on user or computer configuration, the computers or users [or groups of users] must be in the OU. An OU is a container for collecting objects in AD and a computer, user are objects. You can't apply a GP to a user or a computer you can apply GP to a site, domain or OU. So for a GPO to have effect to users or computers, they must be collected into an OU OR for domain wide GP you change the default domain GP [however you really shouldn't do this. GPs are best kept simple and at the OU level AND OUs should be kept 1 to 2 levels deep for simplistic sake.

by cg it

what probably is happening is that you did not collect the users you want the policy to be enforced into the OU you attached the GPO to. Thats about the only way a no overide GPO on a OU wont work. Theres nothing in the OU for the policy to apply to. Therefore users or computer are not affected by the GPO and the default local domain GP is the last GPO to be applied.

This discussion is closed to new replies.