IT Employment

Ask something
Discussion Locked

2003 Server to XP policy failures

0 helpful
2 replies

by david

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Greetings,

I have implemented a new 2003 Server with XP Clients. The issue I'm having is that policy changes on the server aren't occurring at the clients. I "enabled" the User policy to remove the run command. It still appears. Any other changes that are enabled/disabled don't show on the clients at all.

As a related oddity - when I first started reviewing the policys in 2003 Server I "enabled" file sync on Logout - I've since disabled this but my clients keep doing it.

I've waited over 12 hours for these changes to start occuring on the clients.

Any thoughts?

Regards
David Clemons
david@dc911.us

2 replies

by bfilmfan

Where did you apply the policy? At the domain, site or OU level?

Have you checked to make sure that all clients (user or computer) are able to read the policy?

Recall that Fodler Redirection along with Software Installation policies only apply when the client reboots.

When you use Group Policy to specify central settings you want to ensure that they are set at the client without the user being able to change them. To do this you must configure the specific Group Policy client-site extension to ?Process even if the Group Policy Object has not changed.' Has this been done?

If no changes are discovered, GPOs are not processed, but the security policies are. For security policies, there is a registry value that sets a maximum limit of how long a client can function without reapplying non-changed GPOs. By default, this setting is every 16 hours plus the randomized offset of up to 30 minutes. Even when GPOs that contain security policy settings do not change, the policy is reapplied every 16 hours.

To see if the changes are applying on target users and systems, open up a command line on a system and input the following commands:

XP Systems
Gpupdate /target:Computer
Gpupdate /target:User

Windows 2000 systems
Secedit /refreshpolicy machine_policy
Secedit /refreshpolicy user_policy

Let me know if you need further assistance with this issue.

by house

I hate when people beat me to the answer. It's a good thing that there was only one response to read...saved me a lot of typing.

We had a similar problem with a preconfigured local policy on our rollouts. We set the background and tinkered with the control panel and display setting policies (including active desktop). Our users were still able to right click on an image and set it as background. We played around in a lab setting for a bit, but the problem seemed to solve itself and the option is now greyed out. To this day, I still don't know how they were able to do that.

This discussion is closed to new replies.