Solved

Group Policy applies User settings but not Computer settings.

Posted on 2012-03-11
11
336 Views
Last Modified: 2012-05-29
I am setting up a new Windows Server 2008 R2 with a test environment of a Windows 7 PC and a Windows XP PC.  I have created Users and Groups and defined several GPOs for different Groups, where generally each set of Users in a Group have been placed in their own OU, and the test PCs are in separate sub-OUs for each Operating System (Win7 and WinXP) beneath an OU for Computers.

When testing various GPOs I find that settings for both Users and Computers work for the Users on WinXP PCs, but only for Users on Win7 PCs.  I have run RSoP on the test Win7 PC when logged in as different Users, and on each occassion a message saying "access denied" for the computer settings in the GPO, and "no data collected" in the results.

I cannot see any relevant Events in the Event Logs that would help.  I have disabled UAC on the Windows 7 test PC, but no change.

What access permissions are not applied so that the GPO's Computer settings work?
0
Comment
Question by:Axiomit
  • 7
  • 4
11 Comments
 
LVL 11

Expert Comment

by:Ackles
ID: 37707926
Hi,
Not seeing results in policy doesn't mean that computer policy is not applied, it just means that the current user is not having permission to see the policy applied.

A
0
 
LVL 11

Expert Comment

by:Ackles
ID: 37707936
On Windows Vista and later, regular users can only see the user half of the
RSoP by default. They must be delegated the “Read Group Policy Result data” right over the computer they want to gather the information for.

Go on GPMC , click on GPO , go to delegation tab & then for the group of users click on Permissions Drop Down & then assign them, Read Group Policy Results Data.

Log on W7 machine, run gpupdate /force & then see gpresult.

A
0
 
LVL 1

Author Comment

by:Axiomit
ID: 37710649
Thanks  -  I think you are on the right track.  When I login as domain administrator onto Win7 PC and re-run the RSoP for the previous user on that PC I get both Computer and User settings displayed.

Then on the server I opened GPMC, selected a GPO, selected delegation tab,  right clicked on a user group and the drop down list showed:-
Read
Edit settings
Edit settings, delete, modify security
Remove

No trace of "Read Group Policy Results Data"

This is on a server 2008 R2 - is it different here?
0
 
LVL 1

Author Comment

by:Axiomit
ID: 37710686
I would be much happier testing my GPOs if I could see the RSoP for each user on the logged on PC.  I suppose that I could make each user a (temporary) member of Domain Admins just to run the RSoP but is really distorting the results!
0
 
LVL 11

Expert Comment

by:Ackles
ID: 37710789
Why don't you just run RSOP from GPMC on Server?
But before you do that, enable this policy so firewall lets you go through:

Computer Configuration | Policies | Administrative Templates | Network | Network Connections | Windows Firewall | Domain Profile | Windows Firewall: Allow Inbound Remote Administration Exception

One more thing, the user has to logon once on the PC of which you want the RSOP to run.

Let me know, if that works for you?

A
0
The curse of the end user strikes again      

You’ve updated all your end user’s email signatures. Hooray! But guess what? They’re playing around with the HTML, adding stupid taglines and ruining the imagery. Find out how you can save your signatures from end users today.

 
LVL 11

Expert Comment

by:Ackles
ID: 37906175
Any News?
0
 
LVL 1

Author Comment

by:Axiomit
ID: 37939134
I have found that I have to disable the Windows Firewall as it applies to the Domain so that I can get GPOs to work for Computer as well as users with Windows 7 client PCs and 2008 R2 server OS.
0
 
LVL 11

Expert Comment

by:Ackles
ID: 37939141
How did you reach to that conclusion?
0
 
LVL 1

Author Comment

by:Axiomit
ID: 37943302
I was getting "Access denied" errrors when trying to implement the Computer settings in a GPO - there seemed to be a connection between the Firewall settings and being able to browse PCs from the server 2008 R2.
0
 
LVL 11

Expert Comment

by:Ackles
ID: 37943526
As a test can you please give one of the client a Static IP with Primary DNS specified?
A
0
 
LVL 11

Accepted Solution

by:
Ackles earned 500 total points
ID: 37943572
See, the policy I gave you up is actually poking a hole in Firewall to run RSOP from the GPMC.
However, even if the Firewall is on it should not restrict from applying GPO.
If that is happening then there is something to be resolved, as you don't want to bring the Firewall down (I guess).
But, even if you bring down the Domain Firewall, it shouldn't matter much. (that is purely your decision).

Just for bit of convenience you can configure these two GPO's also at Domain Level:
1) Computer Configuration | Policies | Administrative Templates | System | Logon Always wait for the network at computer startup and logon policy

This GPO will make sure that all the GPO's apply before the user log's on. That way you will be sure that policies are applied before user get's in.

2) Computer Configuration | Policies | Administrative Templates | System | Verbose vs Normal Status messages

This will make sure that you not only see the stupid windows circle when the user logs on, but tells you exactly what is happening as to what policies are being applied.

A
0

Featured Post

6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

Join & Write a Comment

A procedure for exporting installed hotfix details of remote computers using powershell
A safe way to clean winsxs folder from your windows server 2008 R2 editions
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

759 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now