Solved

Content Rating GPO applies to all users?

Posted on 2010-11-27
5
737 Views
Last Modified: 2012-05-10
Hey

I have create a GPO (applying content rating in Internet Explorer) - A terminal server enviroment

I have only linked the GPO to a certain OU - but the content rating is enabled for all my users - even user not in the OU - where the GPO is linked.

The user outside the OU - does not get the GPO applied (gpresult)

Why? .. the content rating is a user setting?

Mike
0
Comment
Question by:mikeydk
  • 2
  • 2
5 Comments
 
LVL 14

Expert Comment

by:canali
ID: 34221810
Probably you have a "loopback policy"

http://support.microsoft.com/kb/231287
Group Policy applies to the user or computer in a manner that depends on where both the user and the computer objects are located in Active Directory. However, in some cases, users may need policy applied to them based on the location of the computer object alone. You can use the Group Policy loopback feature to apply Group Policy Objects (GPOs) that depend only on which computer the user logs on to.

Gastone Canali
0
 

Author Comment

by:mikeydk
ID: 34222243
The problem is not related to loopback...
0
 
LVL 7

Expert Comment

by:tstritof
ID: 34222666
Is your GPO in any way linked to OU that terminal server belongs to?
0
 

Author Comment

by:mikeydk
ID: 34224814
tstritof> Nope...

0
 
LVL 7

Accepted Solution

by:
tstritof earned 500 total points
ID: 34225455
Well... I'll be doing some guessing here based on some assumptions.

Here are the assumptions:
- you have defined a GPO for applying the content rating settings in IE
- you have defined the OU that has this GPO linked
- you have tested the content ratings GP application by placing your user account into the OU
- you have tested the content ratings GP "unapplication" by removing your user account from the OU
- the GPO is not linked to the OU container of the computer on which you are testing the GPO

The possible reasons for the content ratings GP still being applied for the user/computer account not in the OU with gpresult showing GP not applied to user/computer combination (this is the guessing bit):
- the ratings settings have been manually set in Internet Options in IE (as part of testing process) and not reset afterwards,
- the ratings settings have been set through Local Policy on the computer (as part of the testing process) and not reset afterwards,
- the gpresult has been run after changing user's membership in an OU but before actually performing logoff/logon or running gpupdate at command prompt and restarting IE
- the GPO has been linked to the computers OU at some point in time and the computer has not been restarted or gpupdate run at command prompt before running gpresult,
- you are using mandatory user profile with content ratings manually set (longshot).

I'd try elimination process here. First make sure you are not using mandatory profiles.

On DC:
- disable the GPO (GPO status > All Settings Disabled).

On test computer:
- log on as the user that shouldn't have the GP applied (not in the test OU),
- run gpupdate /force at command prompt of test computer,
- run gpresult (no ratings settings should appear),
- restart (or start) IE, check Internet Options - if ratings settings are still there try disabling them right there,
- restart IE, check Internet Options - ratings should be disabled - check the behavior by browsing some test sites,
- perform logoff/logon,
- start IE, check Internet Options - ratings should be disabled - if they are not check Local Policy settings on the test computer and rerun gpresult.

If you manage to establish the desired behavior (no content ratings applied) perform the following steps:

On DC:
- enable the GPO (GPO Status > Enabled).

On test computer:
- log on as the user that shouldn't have the GP applied (not in the test OU),
- run gpupdate /force at command prompt of test computer,
- run gpresult (no ratings settings should appear),
- restart (or start) IE, check Internet Options - ratings should be disabled - check the behavior by browsing some test sites,
- log on as the user that should have the GP applied (in the test OU),
- start IE, check Internet Options - ratings should be enabled - check the behavior by browsing some test sites,
- if the ratings are not applied run gpresult (ratings settings should appear),
- run gpupdate /force at command prompt of test computer,
- restart IE, check Internet Options - ratings should be enabled - check the behavior by browsing some test sites.

If you'll run the troubleshooting steps I recommended please copy/paste the steps in your reply and add your comments on the results of each step.

Regards,
Tomislav
0

Featured Post

Want to promote your upcoming event?

Attending an event? Speaking at a conference? Or exhibiting at a tradeshow? Easily inform your contacts by using a promotional banner in your email signature. This will ensure your organization’s most important contacts are in the know.

Join & Write a Comment

Recently, I was asked to look into SCCM 2007 by my employer, having a degree of experience of earlier versions of SMS and some previous SCCM knowledge I didn't expect the procedure to involve to much time. I read a number of guides concerning it…
Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

747 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now