GPOs won't run on 2012 R2 AD DC with DRP

Posted on 2014-12-09
Last Modified: 2014-12-15
I have a very irritating problem where GPOs won't apply on my RDP users on AD DC with RDP server (TS).

There are two test policies, removal of Recycle Bin and one startup script with SUSBT command, but neither runs, and RSoP gives positive results for both.

Can anyone help?


UPDATE: I have tried enforcing the policies, and forced gpupdate, from admin account, but neither worked.
Question by:mrmut
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 2
LVL 19

Expert Comment

by:Miguel Angel Perez Muñoz
ID: 40490646
Removal of Recycle Bin is a user GPO, only fail on DC or on all computers? could you check your GPO link is on users container?

Expert Comment

by:Thomas Wheeler
ID: 40490648
What are the results of gpresult /v do you see the policies?  Are there event logs showing errors ?

Author Comment

ID: 40490699
Everthing passwed without errors. Tried Win+R command, and it worked.

Will check errors and report back.
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)


Author Comment

ID: 40490730
I see no errors i Applications log. Any other place to check?

Expert Comment

by:Thomas Wheeler
ID: 40490762
Did gpresult show your policies?

Author Comment

ID: 40490774
Yes. As applied group policy objects.

I tried "shaking" the system (restart), and the Recycle bin and some other settings work fine now, however my startup command with subst doesn't seem to work. (I will go and check permissions now)

Author Comment

ID: 40490785
Checked it - permissions are OK

Author Comment

ID: 40490954
I tried using map network drive (hosted on the same machine), and that worked with no problems.
However, using map instead subs for local usage is bad performance wise.

Accepted Solution

mrmut earned 0 total points
ID: 40492521
I solved it.

It seems that subst is not on the same permission elevation as the user, thus it is shown in another space, "invisible" to the user.

 I have ammended this by creating "permanent" registry subst by adding:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\DOS Devices





It works.

Author Closing Comment

ID: 40499986
This worked.

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
This process allows computer passwords to be managed and secured without using LAPS. This is an improvement on an existing process, enhanced to store password encrypted, instead of clear-text files within SQL
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…

635 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question