Solved

Problem with IE GPO updating

Posted on 2011-03-04
6
384 Views
Last Modified: 2012-06-21
I am working on creating several GPOs to make custom change to IE.  I have created a temporary OU and assigned a GPO to it. I have made the appropriate changes to the GPO.  I have added a specific test PC and test user to the OU.

When I log in for the first time, IE changes appropriately. I have made subsequent changes to the GPO and do a gpupdate /force to put these into effect immediately and when I look at IE the changes are there.  

So I wanted to test this more in the real world, so I log on as my test user, make some change in IE that is controlled by the GPO like changing the home page or the proxy IP address and then I log out.  When I log back in, I guess I would expect the GPO to be applied appropriately, but when I check IE the changes I made have NOT been over written by the GPO.

I've also gone into the GPO and set the refresh interval on both computer and user config to be 1 minute with an offset of one minute. I have reapplied the GPO by using the gpupdate /force command and then made changes in IE to settings that are controlled by the GPO.  I wait several minutes for the GPO to be reapplied, but it never overwrites the changes.

What am I missing?
0
Comment
Question by:jhyiesla
  • 4
  • 2
6 Comments
 
LVL 8

Expert Comment

by:devinnoel
ID: 35039823
RSoP is your friend when messing with GPO debugging, it's a MMC snap-in that should be installed by default.
http://support.microsoft.com/kb/323276

First off for troubleshooting... Are you messing with the Computer or User section of the GPO? If you have a computer in and OU and apply a GPO with User settings, there is no User account to apply the GPO to. You'd need to create a test user OU containing a test user & apply the GPO to that OU.
0
 
LVL 28

Author Comment

by:jhyiesla
ID: 35043745
Not at work right now, so can't run the MMC Snap-in.  

However, to answer you other questions:  I am setting both the computer and the user sections.  For this testing I have created a temp OU, linked the GPO to the OU and put in one test PC and a test user.  I am logging on at the test user, making the changes and then either staying on as the test user waiting for time to pass and/or logging off and back on as the test user.  The only thing that seems to replace my changes with the GPO is when I do a gpupdate /force.
0
 
LVL 28

Author Comment

by:jhyiesla
ID: 35069025
I ran the RSoP today and it's reporting all of the changes that I have in place. I've even tried filtering by a security group and putting in the user and PC in the group, again on the initial load everything looks OK, but if I go in and manually change a setting in IE that is controlled by the GPO, either waiting or logging out and back in does NOT change the setting back to what it should be.  Only the gpupdate /force works.
0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 
LVL 8

Expert Comment

by:devinnoel
ID: 35070661
GPO refresh time can be changed, but defaults to every 90 minutes (5 minutes for DCs) and at bootup/login (by default). You can change the interval and even disable the background refresh (Set GPO settings to mess with the GPO implementation)


http://technet.microsoft.com/en-us/library/cc940895.aspx (How to mess with GPO refresh & similar settings)
http://technet.microsoft.com/en-us/library/cc758898%28WS.10%29.aspx (How/when the GPO's are applied)


0
 
LVL 28

Author Comment

by:jhyiesla
ID: 35070714
Thanx, but as I noted in my question, I've already changed the refresh interval on both computer and user config to one minute with a  one minute off-set.  I wait and nothing happens. Even when I log in the GPO doesn't change the IE settings back.  The only thing that I have found that does is doing gpupdate /force.
0
 
LVL 28

Accepted Solution

by:
jhyiesla earned 0 total points
ID: 35083153
Nothing worked, except adding gpupdate /force to the login script.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
For both online and offline retail, the cross-channel business is the most recent pattern in the B2C trade space.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question