PC Review


Reply
Thread Tools Rating: Thread Rating: 2 votes, 1.00 average.

Group Policy Not Applying Unless User is Part of Administrators Group

 
 
octavian32@gmail.com
Guest
Posts: n/a
 
      4th Apr 2005
I would appreciate any ideas anyone may have.

The only way I can get a GPO to populate is to grant administrator
rights to the user. If I don't, the policy does not apply. All the
policy is supposed to do is configure proxy settings for Internet
Explorer. However, the problem gets trickier: The problem only occurs
on the current image we are deploying. If I install Windows 2000 from
scratch on a PC, the GPO will come through with no problems (and I will
not need to grant the user admin. rights!). I need to find what is
causing the problem on the current image.
If helpful, I can include a copy of the UserEnv.log file.

Thank you in advance for any help / ideas anyone may have.

Cheers!

 
Reply With Quote
 
 
 
 
Chriss3 [MVP]
Guest
Posts: n/a
 
      4th Apr 2005
If you download the command line gpresult tool, and run it on the client, is
there anything related in the output? I think this is the best way to begin
troubleshooting the issue.

See gpresult:
http://www.microsoft.com/windows2000...gpresult-o.asp

--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup
------------------------------------------------
http://www.chrisse.se - Active Directory Tips

<(E-Mail Removed)> skrev i meddelandet
news:(E-Mail Removed)...
>I would appreciate any ideas anyone may have.
>
> The only way I can get a GPO to populate is to grant administrator
> rights to the user. If I don't, the policy does not apply. All the
> policy is supposed to do is configure proxy settings for Internet
> Explorer. However, the problem gets trickier: The problem only occurs
> on the current image we are deploying. If I install Windows 2000 from
> scratch on a PC, the GPO will come through with no problems (and I will
> not need to grant the user admin. rights!). I need to find what is
> causing the problem on the current image.
> If helpful, I can include a copy of the UserEnv.log file.
>
> Thank you in advance for any help / ideas anyone may have.
>
> Cheers!
>



 
Reply With Quote
 
 
 
 
Oct32
Guest
Posts: n/a
 
      4th Apr 2005
Thanks for the reply.
I did use the gpresult.exe tool. There is no difference when I run the
tool as the user with admin rights and without admin. rights. I even
ran a file compare utility on it. The only mismatch was in the
security privileges section. (that's obvious, because when the user
has admin. rights, he has more privileges).

 
Reply With Quote
 
Chriss3 [MVP]
Guest
Posts: n/a
 
      4th Apr 2005
Have you modify the ACL (Security) of the particular GPO? Ensure that
Authenticated Users has been granted the rights Read and Apply Policy.

--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup
------------------------------------------------
http://www.chrisse.se - Active Directory Tips

"Oct32" <(E-Mail Removed)> skrev i meddelandet
news:(E-Mail Removed)...
> Thanks for the reply.
> I did use the gpresult.exe tool. There is no difference when I run the
> tool as the user with admin rights and without admin. rights. I even
> ran a file compare utility on it. The only mismatch was in the
> security privileges section. (that's obvious, because when the user
> has admin. rights, he has more privileges).
>



 
Reply With Quote
 
Oct32
Guest
Posts: n/a
 
      4th Apr 2005
I checked the GPO and it does have the appropriate rights.
The problem is that if I install Windows 2000 from scratch, the GPO
will apply correctly (and I will not have to grant the user admin.
rights). However, in our current build, the only way to apply the GPO
is to grant the user administrator rights. I can not reimage 3000 PCs
with a new image, therefore I have to troubleshoot what is causing the
problem on the current image. Thank you for your help, it is much
appreciated.

 
Reply With Quote
 
Chriss3 [MVP]
Guest
Posts: n/a
 
      4th Apr 2005
Run rsop.msc on new install, as well run it on a imaged computer, and
compare the result?

--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup
------------------------------------------------
http://www.chrisse.se - Active Directory Tips

"Oct32" <(E-Mail Removed)> skrev i meddelandet
news:(E-Mail Removed)...
>I checked the GPO and it does have the appropriate rights.
> The problem is that if I install Windows 2000 from scratch, the GPO
> will apply correctly (and I will not have to grant the user admin.
> rights). However, in our current build, the only way to apply the GPO
> is to grant the user administrator rights. I can not reimage 3000 PCs
> with a new image, therefore I have to troubleshoot what is causing the
> problem on the current image. Thank you for your help, it is much
> appreciated.
>



 
Reply With Quote
 
Oct32
Guest
Posts: n/a
 
      4th Apr 2005
Can you run it on a Windows 2000 PC?
I tried downloading it but I could not install it on a W2k PC.

 
Reply With Quote
 
mark
Guest
Posts: n/a
 
      5th Apr 2005
Is it possible that the GPO is applying but failing to successfully set
the proxy registry settings? Try adding a policy setting in the GPO
that you can confirm, like hiding a cpanel applet, to verify whether
the GPO is processed at all.

If the GPO if being processed, check the permissions of the registry
key for Internet settings.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\

An alternative might be to just use reg entries in your GPO to push the
values into the registry directly, rather than using the settings in
the GPO template.

 
Reply With Quote
 
Chriss3 [MVP]
Guest
Posts: n/a
 
      5th Apr 2005
Sorry, gpresult is your only option at win2k platform, it gives you the same
output but in text mode.

--
Regards
Christoffer Andersson
Microsoft MVP - Directory Services

No email replies please - reply in the newsgroup
------------------------------------------------
http://www.chrisse.se - Active Directory Tips

"Oct32" <(E-Mail Removed)> skrev i meddelandet
news:(E-Mail Removed)...
> Can you run it on a Windows 2000 PC?
> I tried downloading it but I could not install it on a W2k PC.
>



 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Domain User can't login unless it has local Administrators right Ben Graffery Windows XP General 0 28th Apr 2010 08:25 AM
Windows XP laptop's power profile settings only "stick" when my user account is part of the Administrators group Spin Windows XP General 1 14th Oct 2009 01:50 PM
Adding a domain user a part of administrators group on a workstation using ITDI nitinlalit@gmail.com Microsoft Windows 2000 Networking 0 27th May 2006 12:18 AM
Next Group Policy webcast (Applying Group Policy) Mark Williams [MSFT] Microsoft Windows 2000 Group Policy 0 11th Oct 2004 04:43 PM
add domain administrators into local administrators group from GPO rix Windows XP Security 0 26th Sep 2003 11:34 PM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 05:50 AM.