Need help with gpedit.msc

Refer to my screenshot :

What does the lock mean?  I already login as a administrator.  This server is a DC.

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Hello binary 1001010,

The folder icon that has a lock on it just tells you that the policies contained within them are security related policies.  You are not being restricted in any way from seeing certain policies.

binary_1001010Author Commented:
but i can't change the setting inside, I already logon as administrator.
Now I see that you are looking at the policy from your local computer.  What's happening is that you are receiving policy setting from the domain that are applying to your local PC.  You will not be able to change the policy settings that have the icon that looks like two servers with a script in the middle.  You should be able to change the policies with blue icon though.
Cloud Class® Course: Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

binary_1001010Author Commented:
My Domain span across eight-sites. We have 13 domain controllers.  

I ran "DOMAIN CONTROLLER Security Policy" on one of the server(let's call it TSH-DC), what I added was

a) Allow log on locally
b)Allow log on throught terminal services.

Then I ran gpupdate /force.

Next, I entered gpedit.msc on TSH-DC(as seen in screenshot), the changes wasn't reflected.

But, I check all other DCs in other sites, the changes were reflected.  

Strange if you ask me, the DC that I made changes on wasn't affected, but other sites were affected.

Any comments?

Thanks in advance.
That is strange.  If the TSH-DC is in the same OU as the others, the change should take effect.  Have you tried logging on through TS for that particular DC.  Maybe it's working but not listed for some reason.  I would also give it a little time.  But, really, once you did the gpupdate, it should apply.
binary_1001010Author Commented:
I tried logon throught TS, the error is Insufficient right to logon interactively.  It mean the policy wasnt reflected.....
binary_1001010Author Commented:
i solved my own problem, i need to access GPO management(install from microsoft), check the ou for inherited policy.
Question answered by asker or dialog valuable.
Closed, 30 points refunded.
ee_ai_construct (replacement part #xm34)
Community Support Admin

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2003

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.