Default Domain Policy not being Applied to Clients

[Jay Bollyn]

I have edited the DDP, but the changes are not being applied to the domain clients. I have run the RSoP MMC snap-in on the clients, and a red X appears on the 'computer configuration'. The DDP changes do not appear on the client. They still have the default settings.

I am able to login to the domain from the clients, the DNS seems to be working, I am able to use the 'list in directory' feature for shared printers, etc.

Any idea why my DDP is not being applied to my clients?

:-) Jay

[Norman_21 · Accepted solution]

Jay,

Run gpresult.exe at the client.

also, run rsop.exe at the server and look for anythin that is denying the GPO to the clients. Could it be a WMI Filter set to false?

Let's do a quick trouble shooting.
Create an OU in the DC and create or move a user into the new OU.
Set a new GPO to hide a drive (so that you'll see effect when you login from the client) and link the new GPO to the new OU.

At the client login with the new user and go to Start>Run> and type gpupdate
This should refresh the policy.
Open up my computer and see if the GPO has hidden the drives?

However, you'll need to verify the GPO at the server level using the gpotool.exe :

http://www.microsoft.com/resources/documentation/WindowsServ/2003/all/techref/en-us/Default.asp?url=/Resources/Documentation/windowsserv/2003/all/techref/en-us/gpotool.asp

BTW: I noticed that you opened and closed up the other thread quickly? I hope things are working well with you brother

Hope this help

[Norman_21]

Also, if you could open up your GPO through GPMC and save it as a HTML file then post it here.

At the server you'll need to run the gpupdate. to refresh the policies.

In Windows 2000, the command to refresh the policies was:

secedit /refreshpolicy machine_policy /enforce

In Windows 2003, it's only one word:
gpupdate.exe !

Don't you agree Microsoft is doing a great job!!!

http://www.microsoft.com/resources/documentation/WindowsServ/2003/standard/proddocs/en-us/Default.asp?url=/resources/documentation/windowsserv/2003/standard/proddocs/en-us/secedit_cmds.asp

[Jay Bollyn]

Thanks Latif,

I agree MS has probably done a good job with win2k3. I am early-on in my server admin career, so I really don't have anything else with which to compare. I tend to have more questions than answers at this point in the server admin learning curve.

I don't want to get bogged down in issues that are not really relevant to the 70-270 exam. I will have plenty of time to puzzle over server issues, in prep for the later MCSA exams. I plan to take the 70-270 exam in March.

:-) Jay

[Jay Bollyn]

My above reply was a 'close thread' msg.

I downloaded and installed 'Group Policy Management Console' from MS (just google search for GPMC.MSI).

This told me the 'Default Domain Policy' is NOT Enforced by default. I used GPMC.MSI to ENFORCE the DDP. Works fine now. My policy settings are being applied to the clients.

I will keep this open briefly for comments.

:-) Jay

[Norman_21]

Your doing very well Jay!
I just want to comment that Exam 70-290 & 70-270 are strongly connected so I think it's really better to start with Exam 70-290 which will give strong concept to trouble shoot a client/server issue but I can see that you are getting a hand of it real good!
I guess my point is that you'll have to deal with both even if you plan to take the 70-270 Exam first...

[Norman_21]

Sorry but I forgot to ask if you visited the windows update site after installing GPMC?
http://www.windowsupdate.com

Hopefully, you downloaded the GPMC with SP1
http://tinyurl.com/ysx4u

[Jay Bollyn]

Hi Latif,

I know some people say it is better to take 290 before 270, but I have already agreed to take 270 first. (I am in a study group with another student.)

Yes, I did install GPMC.MSI SP1.

:-) Jay

[Jay Bollyn]

closed