GPO Computer Configuration Not Applying

I'm having some issues getting the Computer Configuration settings to apply to our PC's (all running Windows 7).  After running a GPUPDATE /FORCE and then a GPRESULT the Computer Configuration section indicates "No data available".  I have created a separate GPO "Applies to All PC's" that is supposed to run 2 scripts at startup.  One maps some drives and the other adds some persistent routes.  I have created a new OU ("PC's") and moved my computer objects in "Active Directory Users and Computers" to this OU. I've also linked the new GPO to this OU and enforced it.  I have also "pushed" out this GPO to the OU from the GPO Management program... this generated an update notice on the PC I've been testing on and required a restart of the PC.  Another GPRESULT run and there is still "No data available" under the Computer Configuration section.  Hopefully missing something obvious but haven't been able to find an answer elsewhere.  Please let me know if you require any clarification.

Thanks,
Greg
Greg_L_WERAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Toni UranjekConsultant/TrainerCommented:
Run gpresult from elevated command prompt.
h1r0Commented:
Run gpresult /scope computer from elevated prompt and let me know what you get
Greg_L_WERAuthor Commented:
Thanks for the quick responses :)  This is what I'm getting.  Not sure it's relevant but the user that uses these PC's is not an admin user (User "Counter").  User "Inst" is my local admin user.

Thanks,
Greg

------------------------------------------------------------------------------------------------------------------------------


C:\Windows\system32>gpresult /scope computer /z

Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001

Created On 8/31/2015 at 6:52:11 PM


RSOP data for CRSHQ\inst on CB01-14 : Logging Mode
---------------------------------------------------

OS Configuration:            Member Workstation
OS Version:                  6.1.7601
Site Name:                   Default-First-Site-Name
Roaming Profile:             N/A
Local Profile:               C:\Users\inst.CRSHQ
Connected over a slow link?: No


COMPUTER SETTINGS
------------------
    CN=CB01-14,OU=PC's,DC=CallingwoodRegHQ,DC=com
    Last time Group Policy was applied: 8/31/2015 at 5:10:25 PM
    Group Policy was applied from:      CRS-DC-1501.CallingwoodRegHQ.com
    Group Policy slow link threshold:   500 kbps
    Domain Name:                        CRSHQ
    Domain Type:                        Windows 2000

    Applied Group Policy Objects
    -----------------------------
        APPLIES TO ALL PC's

    The following GPOs were not applied because they were filtered out
    -------------------------------------------------------------------
        Local Group Policy
            Filtering:  Not Applied (Empty)

        Default Domain Policy
            Filtering:  Not Applied (Unknown Reason)

    The computer is a part of the following security groups
    -------------------------------------------------------
        BUILTIN\Administrators
        Everyone
        Debugger Users
        BUILTIN\Users
        NT AUTHORITY\NETWORK
        NT AUTHORITY\Authenticated Users
        This Organization
        CB01-14$
        Domain Computers
        System Mandatory Level

    Resultant Set Of Policies for Computer
    ---------------------------------------

        Software Installations
        ----------------------
            N/A

        Startup Scripts
        ---------------
            GPO: APPLIES TO ALL PC's
                Name:         Drive_Mappings.bat
                Parameters:
                LastExecuted: This script has not yet been executed.

                Name:         DualIP.bat
                Parameters:
                LastExecuted: This script has not yet been executed.

        Shutdown Scripts
        ----------------
            N/A

        Account Policies
        ----------------
            N/A

        Audit Policy
        ------------
            N/A

        User Rights
        -----------
            N/A

        Security Options
        ----------------
            N/A

            N/A

        Event Log Settings
        ------------------
            N/A

        Restricted Groups
        -----------------
            N/A

        System Services
        ---------------
            N/A

        Registry Settings
        -----------------
            N/A

        File System Settings
        --------------------
            N/A

        Public Key Policies
        -------------------
            N/A

        Administrative Templates
        ------------------------
            N/A

C:\Windows\system32>


------------------------------------------------------------------------------------------------------------------------------
This is the same result from a NON-admin user.


C:\Users\COUNTER.CRSHQ>gpresult /scope computer /z
ERROR: Access Denied.
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

yo_beeDirector of Information TechnologyCommented:
Would you be able to post screenshots of the OU structure as well as the GPO (ie security filter)?
yo_beeDirector of Information TechnologyCommented:
Also are you still running Windows 2000 server?
h1r0Commented:
So the gpo is getting applied.  I think you can rule out gpo processing and focus on the gpo itself.  One last thing to try is rebooting the pic.  Many computer policies only execute on boot.    For mapped drives you should probably use the gpo to map drives instead of a script.  You should also check the available drives on the pic in question. Sometimes a bunch of drives are already consumed by usb drives and only visible once you insert media.   Finally is this not working on a single pc or multiple pcs.   I would also try a vey simple policy such as preventing changing the time - this would help you confirm the gpo is at least applying in some capacity.   One other thing to check is the permissions on the gpo itself - it should be readable by domain users
yo_beeDirector of Information TechnologyCommented:
There is an issue with your mapping script. You can not map drives using a startup script, but rather a logon script. So if you want to use your script change it to a logon under User Configuration.

Since you  are using Windows 2000 server from the looks of the RSoP results Group Policy Preferences will not be able to be used unless you install RSAT on a windows 7 machine. I think this is what the previous poster was referencing.

Either way this has to be configured under the User Configuration.

The other script I am not sure what it is supposed to do. It may also need to run at logon rather than startup.
Greg_L_WERAuthor Commented:
Thanks guys.. The server version is 2012 though I've got this same issue at our other office running server 2008.  

It makes sense to move the drive mapping script to the GPO... I'll be sure to do that.  The other script is one to add static routes to each PC.  This issue is happening on multiple PC's. Does the fact that the users that login to these PC's don't have admin rights have any affect on the script being run?  I'd read some other sites and they suggested running the route addition scripts under the computer configuration to get around an elevation issue. I have tried rebooting the PC a few times and when I check my static routes the new ones are not added in.

Forgive my ignorance but when I run the gpresult with no scope should I see both computer and user sections or will it only show computer settings when you include the scope?

Makes sense to try a simple setting to se if it is applied.  I'll give this a shot in the morning when I'm back at the office.

H1R0 - You'd mentioned "One other thing to check is the permissions on the gpo itself - it should be readable by domain users"  Can you explain how I would go about this?

Thanks,
Greg
OU.png
yo_beeDirector of Information TechnologyCommented:
Since you are running a 2008 DC you can leverage Group Policy Preferences (GPP) to map your drives rather than scripting it.

http://blogs.technet.com/b/askds/archive/2009/01/07/using-group-policy-preferences-to-map-drives-based-on-group-membership.aspx

The route script you should test manually to see if it works at all. Since this is a computer setting you should have it run as a startup script.

Are your users and computers in the OU that the GPO is linked to?  If not then the GPO will never apply to the objects.

To help answer your Security question, by default all authenticated Domain objects (computers and users) are able to read GPO's. So if you are not try to block anyone you are all set. Here is a link to MS kb's. https://technet.microsoft.com/en-us/library/Cc781988(v=WS.10).aspx that should help explain it

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Greg_L_WERAuthor Commented:
So it looks like the issue with the static route script was the elevation level.  I ended up moving it into a scheduled task "Run with highest privileges" and it is working on one of my groups.  I've also moved my drive mapping to the "Drive Maps" section under the policy.  So all appears to be working as desired on the one policy.  Unfortunately I haven't been able to figure out why the computer policy wasn't being applied as of yet.  Thanks for all the help getting this far.  I've now got a new semi-related issue but will start a new question for this one.

Thanks,
Greg
yo_beeDirector of Information TechnologyCommented:
Ok.
Glad to help
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.