Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


GPO adm template not staying unchecked

Posted on 2010-09-02
Medium Priority
Last Modified: 2012-06-27
I have added a custom adm template to redirect users favorites folder.  I have to uncheck the "Only show policy settings that can be fully managed" box to get setting to appear in the GPO.  It works great "once".  I log on and the setting is applied correctly.  The problem is if I go into the registry and change my favorites setting under User Shell folders and re-logon, it doesn't get reapplied.  I go back to my GPO and have to uncheck the box again, then re-logon to get the setting applied again.

Is there anyway for this adm to work on every login without having to go into the GPO and uncheck the "Only show policy settings that can be fully managed" box everytime?
Question by:RFiorini
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 3

Expert Comment

ID: 33587746
enforce the policy.

Author Comment

ID: 33587774
The policy is enforced.
LVL 17

Expert Comment

ID: 33588228
The "only show policy setitngs that can be fully managed" is always checked by default.  I don't think there's anything you can do to change it, though.

However, I don't think it's any cause for concern: that setting only affects which policies you see when you edit the GPO: it has no impact on how the GPO is applied.  It's intensely annoying that you have to change the view setting every time you edit GPOs, but that's just the way it works.

Is the GPO linked to the user OU or the server OU? If it's linked to the server OU, be sure that you have loopback policy processing of group policy enabled otherwise the policy won't be applied.  Here's some info on that:

You might want to run GPRESULT in a DOS window to see what policies are being applied.  Here's the MS technet article on how to run GPRESULT from the command line:

Learn Veeam advantages over legacy backup

Every day, more and more legacy backup customers switch to Veeam. Technologies designed for the client-server era cannot restore any IT service running in the hybrid cloud within seconds. Learn top Veeam advantages over legacy backup and get Veeam for the price of your renewal


Author Comment

ID: 33588898
Thanks Alicia for you response.  This is all about redirecting folders.  Tried through GPO.  Sometimes it works, other times not.  Tried through scripts to import registry keys, again, sometimes and sometimes not.  Tried with adm template, again, same pattern.  Does Microsoft do anything that works the same way all the time?  And this all came about because the mapping of a users home directory through the Active Directory sometimes falls short of mapping to the users directory and winds up mapping to the root share.  I'd be seriously chasing my tail if I had one.

Anyway, thanks again for your response.


Accepted Solution

ieden earned 2000 total points
ID: 33649275
I've found that modifying certain defaults in Windows the application of folder redirection can be adversly affected.
1. The HDD needs to be NTFS
2. The My Documents folder needs to be in the Users profile.
3. The Temporary Internet Files folder needs to be in the Local Settings directory of the users profile.
4. Profile must be owned by the user and not a group.

Author Comment

ID: 33649582
Thanks ieden.  I'll give all that a try.

Expert Comment

ID: 33649737
Also in the policy you might want to enable loopback processing.
Setting permissions on redirected folders can be pretty tricky too.

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Did you know that more than 4 billion data records have been recorded as lost or stolen since 2013? It was a staggering number brought to our attention during last week’s ManageEngine webinar, where attendees received a comprehensive look at the ma…
This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question