Solved

GPO Removal Question

Posted on 2008-10-23
7
230 Views
Last Modified: 2012-05-05
In our institute we end users that do either administrative functions or work in labs.  All of which need the ability to logon with their domain credentials.  So we've setup two OU's for those workstations called Admin and Lab.  The computers that the admin persons use have 5 group policy objects applying down to them.  Contained in those GPO's are hunders of federally mandaded settings.  Computes in the LAB ou's CAN NOT have the Federally mandated policies applied to them out of fear these settings will break scientific applicaitons.  
So here's my question  If a comptuer object is moved into the "Admin" OU, thus inheriting those settings, then moved back into the LAB OU, will those federally mandated policies go back to what they were before?
0
Comment
Question by:esbfern
  • 4
  • 2
7 Comments
 
LVL 18

Expert Comment

by:flyingsky
ID: 22789286
To answer your question, yes. They should go back to what they were, unless those GPO for Admin group install some software.
0
 

Author Comment

by:esbfern
ID: 22789355
Can you please show me a microsoft document of this.  I think this depends on the OS and what policy is applied.
0
 
LVL 38

Accepted Solution

by:
Shift-3 earned 500 total points
ID: 22789371
If they are all standard settings then yes, they should go away once the GPO no longer applies to that computer.  However, if that GPO contains custom administrative templates which edit registry entries that aren't under the four dedicated Policies keys then those changes can persist even after the policy is removed.  This is called tattooing the registry.

See these pages for more information:
http://support.microsoft.com/kb/323639
http://www.gpoguy.com/FAQs/Whitepapers/tabid/63/articleType/ArticleView/articleId/5/Understanding-Policy-Tattooing.aspx
0
Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

 
LVL 18

Expert Comment

by:flyingsky
ID: 22789419
One simple way of knowing for sure is do a test. setup a machine in Lab ou, make sure everything works fine, move it to admin ou, force to gpupdate to apply all the GPOs , then take it out and put back to lab.
0
 

Author Comment

by:esbfern
ID: 22789666
It's a little more complicated than that.  Just found this http://technet.microsoft.com/en-us/library/cc736484.aspx
0
 

Author Comment

by:esbfern
ID: 22790813
Shift-3:  How do I know which Group Policies will be put in these locations:  

HKEY_LOCAL_MACHINE\Software\Policies
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies
HKEY_CURRENT_USER\Software\Policies
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies

Are all policies under the administrative templates in these locations?
0
 

Author Comment

by:esbfern
ID: 22797584
Here's the answer for the administrative Templates section of a GPO.  Shift-3 is correct http://technet.microsoft.com/en-us/library/cc736484.aspx 
0

Featured Post

Is Your AD Toolbox Looking More Like a Toybox?

Managing Active Directory can get complicated.  Often, the native tools for managing AD are just not up to the task.  The largest Active Directory installations in the world have relied on one tool to manage their day-to-day administration tasks: Hyena. Start your trial today.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I'm sure that every Windows systems administrator has written, or at least used, a batch or VBS login script at some point in their career, whether it is to map network drives, install printers, or set some user preferences.  No more! With Window…
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

929 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now