Group policy not applying

Jasper Recto

I have 2 subjects here.

First, how do you set the permissions to allow uers to read and apply group
policies?


Second, we have 2 OU for the company, a company user policy and and a
company computer policy. When I run gpresult.exe, it tell's me that the
company computer policy is applied but the company user policy is not. It
says it is being filtered out.

Is it the permissions? If not, why won't the user policy apply.

Also, even though it says that the computer policy is applied, when I go to
a computer and run gpedit.msc, I don't see the changes that should be there.

Any ideas?

Thanks,
Jasper

Vasil Nikolov

Hallo Jasper,

Sie koennen das Tool GPMC(ich empfehle Ihnen das Tool) benutzen.
Herunterladen unter:
http://www.microsoft.com/downloads/d...displaylang=en
Sie koenne vom Tool auf das Linked GPO druecken und rechts gibt es
"Delegation" -> unten rechts gibt es button "Advanced", von da koennten Sie
die Rechte fuer die konkreten Benutzer bestimmen.

1) Wenn Sie sich als BEnutzer, mitglied von Domain Admins oder Enterprise
Admins anmelden, by Default die Rechte fuer "GPO apply" sind nicht
eingestellt und das koennte die Ursache fuer die Situation bei Ihnen sein.
2) gpedit.msc - Das verwaltet nur die Local-Group-Policies nicht die GPOs,
angewendet vom Domain Controller.
3) Es ist gute Praxis, dass Mitglieder von DOmain Admins, von GPO-Anwendung
ausgeschaltet sind.



Mit freundlichen Grüssen / Kind Regards
Vasil Nikolov


"Jasper Recto" <jrecto99@yahoo.com> wrote in message
news:e6aAwKU1IHA.4476@TK2MSFTNGP06.phx.gbl...
>I have 2 subjects here.
>
> First, how do you set the permissions to allow uers to read and apply
> group policies?
>
>
> Second, we have 2 OU for the company, a company user policy and and a
> company computer policy. When I run gpresult.exe, it tell's me that the
> company computer policy is applied but the company user policy is not. It
> says it is being filtered out.
>
> Is it the permissions? If not, why won't the user policy apply.
>
> Also, even though it says that the computer policy is applied, when I go
> to a computer and run gpedit.msc, I don't see the changes that should be
> there.
>
> Any ideas?
>
> Thanks,
> Jasper
>

Florian Frommherz [MVP]

Howdie!

Jasper Recto schrieb:
> First, how do you set the permissions to allow uers to read and apply group
> policies?

Check Group Policy Management Console (GPMC). From there, you can edit
permissions in the "Delegation" tab by adding or deleting people.
Fine-granting permissions can be done with the "Advanced" button.

> Second, we have 2 OU for the company, a company user policy and and a
> company computer policy. When I run gpresult.exe, it tell's me that the
> company computer policy is applied but the company user policy is not. It
> says it is being filtered out.
>
> Is it the permissions? If not, why won't the user policy apply.

No - it's just gpresult's way of saying that the policy applies to user
objects and computers don't apply it. You know, computers only apply
computer settings (from Computer Configuration) and users apply user
settings (from USer Configuration).

> Also, even though it says that the computer policy is applied, when I go to
> a computer and run gpedit.msc, I don't see the changes that should be there.

What setting(s) are you talking about specifically? Is it a Windows XP
or above machine? If so, there's another cool tool that lets you see
what policies are applied, it's called Resultant Set of Policies: rsop.msc.

cheers,

Florian
--
Microsoft MVP - Windows Server - Group Policy.
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Use a newsreader! http://www.frickelsoft.net/news.html

Florian Frommherz [MVP]

Howdie!

Vasil Nikolov schrieb:
> Hallo Jasper,

Thanks for posting, Vasil. As you surely have noticed, this is an
english-speaking/writing newsgroup so people won't understand your
helpful postings as long as you write in German.

cheers,

Florian
--
Microsoft MVP - Windows Server - Group Policy.
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.
Use a newsreader! http://www.frickelsoft.net/news.html

Vasil Nikolov

Hallo Jasper,

You can use the GPMC-tool for managing the GPOs
http://www.microsoft.com/downloads/d...displaylang=en
You can click from the Tool on the Linked GPO and in the right there is
"Delegation" -> and at the bottom right there is a button "Advanced", from
there you can choose the user and change the permissions for applying the
GPO.

1) If you are a member of Domain Admins or Enterprise admins, then by
default this groups are out of applying GPOs... and it's a good praxis I
think
2) gpedit.msc - With this tool you can manage only the local Group policy-
this are overwritten grom the GPOs applyed from the DC.


PS: Sorry for writting in German

Kind Regards
Vasil Nikolov


"Jasper Recto" <jrecto99@yahoo.com> wrote in message
news:e6aAwKU1IHA.4476@TK2MSFTNGP06.phx.gbl...
>I have 2 subjects here.
>
> First, how do you set the permissions to allow uers to read and apply
> group policies?
>
>
> Second, we have 2 OU for the company, a company user policy and and a
> company computer policy. When I run gpresult.exe, it tell's me that the
> company computer policy is applied but the company user policy is not. It
> says it is being filtered out.
>
> Is it the permissions? If not, why won't the user policy apply.
>
> Also, even though it says that the computer policy is applied, when I go
> to a computer and run gpedit.msc, I don't see the changes that should be
> there.
>
> Any ideas?
>
> Thanks,
> Jasper
>