Effect of reverting GP Settings to Not Configured

[Bruce Sanderson]

I can find lots of documentation about how to create GPOs, how they are
implemented etc. and have been using some simple GPOs for some time.

But, I can't find any statements about what happens on the target computers
(Windows XP Pro SP1) if a setting in a GPO is reverted to Not Configured.
Maybe I'm just not looking in the right place.

For example, lets say I create a GPO that sets Computer
Configuration\Administrative Templates\System\System Restore\Turn off System
Restore to Enabled. This GPO then gets applied to a set of computers in the
normal way - in this case my reading tells me that this GPO setting will not
have any affect until the computer is restarted. Lets say all of the
computers get restarted and receive this setting.

So far so good. Now, I want to revert this setting back to the way it was
before, so I use the Group Policy Managment Console again to edit the GPO
and set Computer Configuration\Administrative Templates\System\System
Restore\Turn off System Restore to Not Configured. The target computers get
restarted and receive the new version of the GPO.

Assuming no-one changes the local settings manually (e.g. via System
Properties, System Restore), is System Restore now enabled on all the target
computers or not? The "Explain" for this particular policy says that this
setting will revert to the "default local setting". Ok, what is the
"default local setting" and where is this documented?

Where can I find a document that describes how this aspect of using GPOs
works?

 

[Kevin P. Fleming]

But, I can't find any statements about what happens on the target computers
(Windows XP Pro SP1) if a setting in a GPO is reverted to Not Configured.
Maybe I'm just not looking in the right place.

It's there, you just didn't see it. Unlike NT4, 2000/XP GPOs are not
stored on the target computers _at all_. They take effect only in memory
after they are applied. That means if you "unconfigure" a setting it
disappears, and whatever other GPO or Local Policy that's still in place
takes effect.

That also means that if the computer is booted without access to the
domain (for example a laptop), the GPOs on the domain will _not_ be in
place during that session.