Deathblow
asked on
GPO for Computer Restriction Policy Stopped Working
I have a computer restriction policy defined to certain computers in an OU. This policy has been working for months. This policy is marked enforced. The policy restricts these computers from using Internet Explorer (path rule C:\Program Files\Internet Explorer\IEXPLORE.EXE). This week, the policy stopped working. All of the computers in the OU can now use Internet Explorer. I have verified that the policy has not changed and nothing on these computers looks any different (33 computers).
I deleted the current policy and recreated it; however this had no effect.
I deleted the current policy and recreated it; however this had no effect.
mikeleebrla
if the OS of the clients is XP run gpresult to see if the GPOs are even being pushed down to the clients
ASKER
GPRESULT is showing that this policy is not getting pushed the clients. We checked this; however, this was not the case as of last week. This problem started this week.
well if the policy isn't being pushed to the clients then that is where you need to start,,, of course the policy will not be in effect if its not even being applied
ASKER
That is why I asked my original question. What may be causing this to happen?
can you copy and paste the result of the gpresult??
we had a problem like this on a DC, where something became corrupt with the OS on that machine and then the policies after that weren't applied in the right order, if at all. In this case, replication was also a problem spot.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
kristinaw is right,, that is one of the most often overlooked things when setting up GPOs,,, why they aren't turned on by default ill never know
ASKER
This wasn't overlooked orginally because it worked for months; however, it appears that the permissions had been removed from authenticated users to apply group policy. I'll have to do some internal research to see how that happened. I am testing this now to see if this resolves the problem.