Group Policy Not Applying Unless User is Part of Administrators Group

Discussion in 'Microsoft Windows 2000 Active Directory' started by octavian32@gmail.com, Apr 4, 2005.

  1. Guest

    I would appreciate any ideas anyone may have.

    The only way I can get a GPO to populate is to grant administrator
    rights to the user. If I don't, the policy does not apply. All the
    policy is supposed to do is configure proxy settings for Internet
    Explorer. However, the problem gets trickier: The problem only occurs
    on the current image we are deploying. If I install Windows 2000 from
    scratch on a PC, the GPO will come through with no problems (and I will
    not need to grant the user admin. rights!). I need to find what is
    causing the problem on the current image.
    If helpful, I can include a copy of the UserEnv.log file.

    Thank you in advance for any help / ideas anyone may have.

    Cheers!
     
    , Apr 4, 2005
    #1
    1. Advertisements

  2. If you download the command line gpresult tool, and run it on the client, is
    there anything related in the output? I think this is the best way to begin
    troubleshooting the issue.

    See gpresult:
    http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/gpresult-o.asp

    --
    Regards
    Christoffer Andersson
    Microsoft MVP - Directory Services

    No email replies please - reply in the newsgroup
    ------------------------------------------------
    http://www.chrisse.se - Active Directory Tips

    <> skrev i meddelandet
    news:...
    >I would appreciate any ideas anyone may have.
    >
    > The only way I can get a GPO to populate is to grant administrator
    > rights to the user. If I don't, the policy does not apply. All the
    > policy is supposed to do is configure proxy settings for Internet
    > Explorer. However, the problem gets trickier: The problem only occurs
    > on the current image we are deploying. If I install Windows 2000 from
    > scratch on a PC, the GPO will come through with no problems (and I will
    > not need to grant the user admin. rights!). I need to find what is
    > causing the problem on the current image.
    > If helpful, I can include a copy of the UserEnv.log file.
    >
    > Thank you in advance for any help / ideas anyone may have.
    >
    > Cheers!
    >
     
    Chriss3 [MVP], Apr 4, 2005
    #2
    1. Advertisements

  3. Oct32 Guest

    Thanks for the reply.
    I did use the gpresult.exe tool. There is no difference when I run the
    tool as the user with admin rights and without admin. rights. I even
    ran a file compare utility on it. The only mismatch was in the
    security privileges section. (that's obvious, because when the user
    has admin. rights, he has more privileges).
     
    Oct32, Apr 4, 2005
    #3
  4. Have you modify the ACL (Security) of the particular GPO? Ensure that
    Authenticated Users has been granted the rights Read and Apply Policy.

    --
    Regards
    Christoffer Andersson
    Microsoft MVP - Directory Services

    No email replies please - reply in the newsgroup
    ------------------------------------------------
    http://www.chrisse.se - Active Directory Tips

    "Oct32" <> skrev i meddelandet
    news:...
    > Thanks for the reply.
    > I did use the gpresult.exe tool. There is no difference when I run the
    > tool as the user with admin rights and without admin. rights. I even
    > ran a file compare utility on it. The only mismatch was in the
    > security privileges section. (that's obvious, because when the user
    > has admin. rights, he has more privileges).
    >
     
    Chriss3 [MVP], Apr 4, 2005
    #4
  5. Oct32 Guest

    I checked the GPO and it does have the appropriate rights.
    The problem is that if I install Windows 2000 from scratch, the GPO
    will apply correctly (and I will not have to grant the user admin.
    rights). However, in our current build, the only way to apply the GPO
    is to grant the user administrator rights. I can not reimage 3000 PCs
    with a new image, therefore I have to troubleshoot what is causing the
    problem on the current image. Thank you for your help, it is much
    appreciated.
     
    Oct32, Apr 4, 2005
    #5
  6. Run rsop.msc on new install, as well run it on a imaged computer, and
    compare the result?

    --
    Regards
    Christoffer Andersson
    Microsoft MVP - Directory Services

    No email replies please - reply in the newsgroup
    ------------------------------------------------
    http://www.chrisse.se - Active Directory Tips

    "Oct32" <> skrev i meddelandet
    news:...
    >I checked the GPO and it does have the appropriate rights.
    > The problem is that if I install Windows 2000 from scratch, the GPO
    > will apply correctly (and I will not have to grant the user admin.
    > rights). However, in our current build, the only way to apply the GPO
    > is to grant the user administrator rights. I can not reimage 3000 PCs
    > with a new image, therefore I have to troubleshoot what is causing the
    > problem on the current image. Thank you for your help, it is much
    > appreciated.
    >
     
    Chriss3 [MVP], Apr 4, 2005
    #6
  7. Oct32 Guest

    Can you run it on a Windows 2000 PC?
    I tried downloading it but I could not install it on a W2k PC.
     
    Oct32, Apr 4, 2005
    #7
  8. mark Guest

    Is it possible that the GPO is applying but failing to successfully set
    the proxy registry settings? Try adding a policy setting in the GPO
    that you can confirm, like hiding a cpanel applet, to verify whether
    the GPO is processed at all.

    If the GPO if being processed, check the permissions of the registry
    key for Internet settings.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet
    Settings\

    An alternative might be to just use reg entries in your GPO to push the
    values into the registry directly, rather than using the settings in
    the GPO template.
     
    mark, Apr 5, 2005
    #8
  9. Sorry, gpresult is your only option at win2k platform, it gives you the same
    output but in text mode.

    --
    Regards
    Christoffer Andersson
    Microsoft MVP - Directory Services

    No email replies please - reply in the newsgroup
    ------------------------------------------------
    http://www.chrisse.se - Active Directory Tips

    "Oct32" <> skrev i meddelandet
    news:...
    > Can you run it on a Windows 2000 PC?
    > I tried downloading it but I could not install it on a W2k PC.
    >
     
    Chriss3 [MVP], Apr 5, 2005
    #9
    1. Advertisements

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. kidem

    group policy not fully applying

    kidem, Jul 10, 2003, in forum: Microsoft Windows 2000 Active Directory
    Replies:
    0
    Views:
    482
    kidem
    Jul 10, 2003
  2. Guest

    Applying Group Policy to a Group

    Guest, Jan 5, 2004, in forum: Microsoft Windows 2000 Active Directory
    Replies:
    3
    Views:
    220
    Ken Butler
    Jan 8, 2004
  3. Edwyn

    Multiple administrators, Site Administrators

    Edwyn, Feb 17, 2004, in forum: Microsoft Windows 2000 Active Directory
    Replies:
    1
    Views:
    292
    Chriss3
    Feb 17, 2004
  4. Jimmy Andersson [MVP]

    Re: Applying Group policy to a security group

    Jimmy Andersson [MVP], May 11, 2004, in forum: Microsoft Windows 2000 Active Directory
    Replies:
    0
    Views:
    231
    Jimmy Andersson [MVP]
    May 11, 2004
  5. Guest

    Authentication issue preventing Group Policy from applying to user

    Guest, Jan 23, 2006, in forum: Microsoft Windows 2000 Active Directory
    Replies:
    6
    Views:
    5,416
    Guest
    Jan 27, 2006
Loading...

Share This Page