Software

Ask something
Question Locked

Group policy not setting

0 helpful
14 replies

by rapell

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Hello, I am the administrator of a small AD site on a windows 2003 network. Recently the company decided that all user desktop wall paper would be the same with company logo. I decided to try and do this via group policy, but 1 month down the road and none of the machines has taken up the logo wall paper. I have configured a new GPO and blocked inheritance but still nothing. What could be the issue? Thanks

14 replies

by dedlbug

Just to get on the same page, do you already have a policy that is enabled and working on the LAN currently? If you configured a new GPO, you will have to enable it and make sure your Domain is linked to that GPO. It's not best practice to edit the Default Domain policy, but you can always try that.

The setting that you have to change is in User Configuration - Administrative Templetes - Desktop - Active Desktop - Active Desktop Wallpaper. You have to enable this policy and you can enter a path for an existing image to use. I'm not sure, but I think there is a work around for users in the domain to be able to bypass this setting, but it will prevent the "Right-click on Desktop/Properties" that users commonly do to change the wallpaper.

by rapell

but still the same thing, the GPO linked and enabled. Is there any command I can use on a client and it applied the wall paper? apart from gpupdate /force?

by jclalama

In order to GPO relationed with wallpaper function check the next policies aldo are enabled:
User Configuration
Administrative Templates
Desktop/Active Desktop
Wallpaper Name: Your wallpaper
Enable Active Desktop: Allows HTML
and JPEG Wallpaper

Otionasl are:
Prohibit adding items Enabled
Prohibit changes Enabled
Prohibit closing items Enabled
Prohibit deleting items Enabled
Prohibit editing items Enabled

After that, try with the Group Policy Result in order to chech your entire policy.

Good Luck Friend

by smilingsheep

1. Make sure the new policy and all policies are set to merge. I've seen some weird non-results with the processing set to overwrite.

2. Use GPMC to run a resultant set of policy on one use on a particular machine to make sure the policy is effectively applying.

3. Put the background image locally on the workstations and path relatively to it. Don't try to load the background image from a file server/share.

4. Look for policy errors in the workstations after a reboot or gpupdate /force. Sometimes the part of the GPO that's failing to apply will generate a log entry.

by john.light

Why did you block inheritance?

to help debug.. use GPMC to get a RSOP on a computer. Also turn debug on and look at the more detail login c:\window\debug\UserMode\userenv.log
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserEnvDebugLevel"=dword:00010002

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics]
"FdeployDebugLevel"=dword:0x0f

by retro77

-Where do you the GPO applied?

-Is this a machine based GPO or a User based GPO?

-Write a script to copy that wall paper to the C:\Windows directory on all of the workstations. Have the GPO point to that location for the wallpaper

-Dont have a space in the name of the wallpaper.

by rapell

GPO. I guess I got the problem(if it is actually the problem). Maybe you pros out there may investigate and comment, please. thanks.
Now, I had bundled up all the users in my OU into a security group, and also all the computers into another security group when the GPO was not applying. So i decided to remove myself from the security group, and add my username to the OU as is. The did gpupdate /force and it worked almost immediately on my desktop. I proceeded to remove all users from the security group as well and the next day when they logged into their systems, it also worked. I wonder why?? After all, the security group was in the OU! Thanks for all contributions.

by smilingsheep

Its not apparent if you're using GPMC, but you'll want to look at the security settings, specifically who has read & apply policy settings rights. Although the security group was in the same OU as the policy, the security must be set properly for the GPO to apply to a group (even if the group is Authenticated Users).

by abriere

A user-based policy can only be applied to a user and a computer-based policy can only be applied to a computer. That's why your GPO worked when adding yourself to the GPO instead of adding your computer. In order for a user-based policy to be applied to a computer, whatever user is logged in, enable Loopback Processing. This has the consequence to:
1. Apply computer policies when computer starts up;
2. Apply user policies when a user logs in;
3. Reapply computer policies to any logged-in user
Grour security are used to filter (out) users or computers; GPOs are not applied to them, but only to members of the GPO.

Andr? Bri?re

by rapell

what do you mean? much as it has worked, I would have liked to not disrupt my settings just to make a desktop look like a logo, so many settings have been lost. Please elaborate and give workaround to doing this and it propagates to security group. Thanks

by cg it

OUs are containers. They don't necessarily have to be security groups. you want security groups when you need to restrict access [or grant access].

if you want to control user desktop experience, you don't need OUs created in a security group to do that.

you could create and if that OU is nested inside another OU, the child [OU you created] inherits the parents plus the GPO you applied to the child. The resulting set might conflict [parent/child] so the parent applies [which means your GPO with the wall paper doesn't get applied].

could be a lot of things.........

tough to say without seeing a diagram of the OU structure and the GPOs assigned to OUs.

by abriere

I just want to make a correction. When you enable Loopback Processing, the user settings of a GPO are applied to an OU members, even if it contains only computers. Without it, the user settings are applied to the OU's users if any, and the computer settings are applied to the OU's computers.
Also, policies are applied to the members of an OU, not to members of a GPO, as I said previously.

Andr? Bri?re

by bhavyangraj

First of all set a mandotary profile with your wallpaper which you want to set for all domain users. after setting GPO it will be done.

if this doesn't work then you contact me I will solve your problem.

This discussion is closed to new replies.