?
Solved

Content Rating GPO applies to all users?

Posted on 2010-11-27
5
Medium Priority
?
784 Views
Last Modified: 2012-05-10
Hey

I have create a GPO (applying content rating in Internet Explorer) - A terminal server enviroment

I have only linked the GPO to a certain OU - but the content rating is enabled for all my users - even user not in the OU - where the GPO is linked.

The user outside the OU - does not get the GPO applied (gpresult)

Why? .. the content rating is a user setting?

Mike
0
Comment
Question by:mikeydk
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
5 Comments
 
LVL 14

Expert Comment

by:canali
ID: 34221810
Probably you have a "loopback policy"

http://support.microsoft.com/kb/231287
Group Policy applies to the user or computer in a manner that depends on where both the user and the computer objects are located in Active Directory. However, in some cases, users may need policy applied to them based on the location of the computer object alone. You can use the Group Policy loopback feature to apply Group Policy Objects (GPOs) that depend only on which computer the user logs on to.

Gastone Canali
0
 

Author Comment

by:mikeydk
ID: 34222243
The problem is not related to loopback...
0
 
LVL 7

Expert Comment

by:tstritof
ID: 34222666
Is your GPO in any way linked to OU that terminal server belongs to?
0
 

Author Comment

by:mikeydk
ID: 34224814
tstritof> Nope...

0
 
LVL 7

Accepted Solution

by:
tstritof earned 2000 total points
ID: 34225455
Well... I'll be doing some guessing here based on some assumptions.

Here are the assumptions:
- you have defined a GPO for applying the content rating settings in IE
- you have defined the OU that has this GPO linked
- you have tested the content ratings GP application by placing your user account into the OU
- you have tested the content ratings GP "unapplication" by removing your user account from the OU
- the GPO is not linked to the OU container of the computer on which you are testing the GPO

The possible reasons for the content ratings GP still being applied for the user/computer account not in the OU with gpresult showing GP not applied to user/computer combination (this is the guessing bit):
- the ratings settings have been manually set in Internet Options in IE (as part of testing process) and not reset afterwards,
- the ratings settings have been set through Local Policy on the computer (as part of the testing process) and not reset afterwards,
- the gpresult has been run after changing user's membership in an OU but before actually performing logoff/logon or running gpupdate at command prompt and restarting IE
- the GPO has been linked to the computers OU at some point in time and the computer has not been restarted or gpupdate run at command prompt before running gpresult,
- you are using mandatory user profile with content ratings manually set (longshot).

I'd try elimination process here. First make sure you are not using mandatory profiles.

On DC:
- disable the GPO (GPO status > All Settings Disabled).

On test computer:
- log on as the user that shouldn't have the GP applied (not in the test OU),
- run gpupdate /force at command prompt of test computer,
- run gpresult (no ratings settings should appear),
- restart (or start) IE, check Internet Options - if ratings settings are still there try disabling them right there,
- restart IE, check Internet Options - ratings should be disabled - check the behavior by browsing some test sites,
- perform logoff/logon,
- start IE, check Internet Options - ratings should be disabled - if they are not check Local Policy settings on the test computer and rerun gpresult.

If you manage to establish the desired behavior (no content ratings applied) perform the following steps:

On DC:
- enable the GPO (GPO Status > Enabled).

On test computer:
- log on as the user that shouldn't have the GP applied (not in the test OU),
- run gpupdate /force at command prompt of test computer,
- run gpresult (no ratings settings should appear),
- restart (or start) IE, check Internet Options - ratings should be disabled - check the behavior by browsing some test sites,
- log on as the user that should have the GP applied (in the test OU),
- start IE, check Internet Options - ratings should be enabled - check the behavior by browsing some test sites,
- if the ratings are not applied run gpresult (ratings settings should appear),
- run gpupdate /force at command prompt of test computer,
- restart IE, check Internet Options - ratings should be enabled - check the behavior by browsing some test sites.

If you'll run the troubleshooting steps I recommended please copy/paste the steps in your reply and add your comments on the results of each step.

Regards,
Tomislav
0

Featured Post

Enroll in August's Course of the Month

August's CompTIA IT Fundamentals course includes 19 hours of basic computer principle modules and prepares you for the certification exam. It's free for Premium Members, Team Accounts, and Qualified Experts!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Redirected folders in a windows domain can be quite useful for a number of reasons, one of them being that with redirected application data, you can give users more seamless experience when logging into different workstations.  For example, if a use…
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will walk an individual through the steps necessary to configure their installation of BackupExec 2012 to use network shared disk space. Verify that the path to the shared storage is valid and that data can be written to that location:…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…
Suggested Courses

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question