GPO's only work if user is member of local administrators group on Win2k workstations

I have 2 Windows 2000 Servers, and a whole slew of Win2k workstations.  Currently, all users are members of their pc's Administrators group, but not the Domain Admins group.  We tried to tighten security down and started by removing users from the local admins group.  When I did, all of my GPOs defined in AD Users and Groups stopped working, including scripts and restrictions (screensaver forced to lock, etc).  If I add users back to the local admins, things work great.

Ideas?

Thanx,
Mike
pingkingAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

luv2smileCommented:
Have you checked the security permissions on the GPOs to make sure the domain users group has the appropriate rights?
0
pingkingAuthor Commented:
Authenticated users have read and apply, and I gave write just for kicks.  No dice.
0
luv2smileCommented:
run gpresult.exe from one of the clients to see if it gives you any info such as maybe if there is gpo filtering setup.
0
Cloud Class® Course: Microsoft Office 2010

This course will introduce you to the interfaces and features of Microsoft Office 2010 Word, Excel, PowerPoint, Outlook, and Access. You will learn about the features that are shared between all products in the Office suite, as well as the new features that are product specific.

luv2smileCommented:
On the properties tab of the GPO, go to WMI filter and see if any filters are set up there.
0
pingkingAuthor Commented:
It's a 2000 server, not 2003.  Is WMI available on 2000?  If so, where?
0
pingkingAuthor Commented:
More good news.  Test show that if I create a new user, it works fine.  If I move a current user to a new OU, same problem.  I think it's something with the user accounts themselves.  Afortunadamente, there are less than 50 users, but I would really hate to recreate each and redo profiles.

Aarrgghh
0
TJworldCommented:
Is the event log reporting anything?

0
pingkingAuthor Commented:
Nothing new.  Had a few license errors (really thought I was onto something there), but turned out to be nothing (I had several licenses that had been issued > a year ago that had not been released, so I released them - no help).
0
TJworldCommented:
I'm wondering if somehow those users don't have Apply Group Policy permissions in the GPO?

To check for *each* GPO you have, follow this example:

http://live.tjworld.net/help/ee/Q_21217635a.wmv (Streaming media) or
http://tjworld.net/help/ee/Q_21217635a.wmv (Web download)

0
pingkingAuthor Commented:
Talk about some slow streaming media.  I've verified the permissions on the GPO, and even added domain users as a group (as opposed to authenticated users) and manually set the Read & Apply rights.  Still waiting on that video...
0
pingkingAuthor Commented:
Saw the media, already tried that.  Anything else...
0
TJworldCommented:
I think the connection is under pressure, almost fully saturated with a mega file transfer.

I think you have to examine the file permissions both on the SYSVOL share and also on the local PC in the locations it copies GPO files to.

%systemroot%\security\templates\

To track whats going on how about enabling auditing of file access for that folder and its children, and do the same on the SYSVOL share.

See what the Domain Controller and the Workstation are actually doing and hopefully what is failing?
0
pingkingAuthor Commented:
That's gonna take a little while.  I'll let  you know...
0
pingkingAuthor Commented:
OK.  User has Read/Execute, List & Read on both the SYSVol and local %systemroot%\security\templates directories.  System has full access.  Network does not appear saturated in any way, shape or form (ie. network performance has not degraded in any way).

Whatcha thinK?
0
TJworldCommented:
lol... Network Saturation... i was on about my streaming media connecton :-D

If you can hang on 24 hours I'll post this one to Microsoft Private support see what Microsoft have to say about?
0
swinterbornCommented:
You said that a newly created user gets the GPO's applied correctly. Therefore there are no issues with permissions on the GPO or sysvol. Prime culprit would have to be profiles - I've seen profiles prevent GPO application too many times, the answer has always been to delete the existing profile , let it be recreated from scratch, and then the GPO applies perfectly.

Obviously you would want to test out one profile first to verify this, before going through all of them.

If you are using roaming profiles, make sure you delete both the source profile on the server and any cached copies on workstations. If you believe there may be data on the users desktops, etc, rename the source profile rather than deleting (profilename.bad has always worked for me ;')) but still delete any cached copies.

HTH
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
pingkingAuthor Commented:
I was afraid you were going to say that, and it's just the thing I was trying to avoid.  I'll let you know...

Thanx
0
pingkingAuthor Commented:
I ended up having to recreate nearly EVERY profile.  All of which were roaming.  Ick.  But it's done, and it's working.

Thanx
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 2000

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.