GPO Loopback processing

[Steve]

I have a problem where a GPO with Loopback enabled is
applying the User configuration settings unpredictably.
Sometimes they are applied, then after logging off and
back on again they are not applied.

Anyone know why this is happening? Is there a delay for
the User configuration settings in loopback mode. (The
computer settings are applied every time)

I have turned on logging for the GPOs, there are no
errors. NetDIAG, GPResult and GPOTool also return no
errors.

There are 4 DC's in a child domain, all are have
replication up to date and there are no errors on DNS, or
any of the AD services. All permissions in AD and on the
GPO object are OK.

If the GPO is linked to an OU with the user account it
applies with no problems. (This is not an option though)

 

[Buz [MSFT]]

Even though you are in loopback mode you need to insure that the users have
apply group polciy and read access to the policy in question.

What are the specific settings that are inconsistant? Do the policies
consistantly not apply at reboot however they always apply at logoff logon?

Are you getting errors about not being able to unload the profile in the
Application log?

Here are some other ideas:

Add the machine account of the terminal server to the GPO security settings.

On the properties of the policy object on the General tab, verify that
Disable User Configuration Settings is not selected.

Remove the check from "Disable User Configuration settings"

Buz Brodin
MCSE NT4 / Win2K
Microsoft Enterprise Domain Support

Get Secure! - www.microsoft.com/security

This posting is provided "as is" with no warranties and confers no rights.

Please do not send e-mail directly to this alias. This alias is for
newsgroup purposes only.

 

[Steve]

No errors in any event logs, all permissions are OK
(Authenticated Users and a self created group both have
proper permissions, Read and Apply Group policy, Deny is
only set on Domain Administrators, Machine Account is
added)

Disable User Configuration is not selected

Settings not applied are things such as Hide Desktop
Icons (Basically any settings under user configuration)
and there is no consistency whatsoever.

 

[Buz [MSFT]]

No idea at this point:

No errors in any event logs, all permissions are OK
(Authenticated Users and a self created group both have
proper permissions, Read and Apply Group policy, Deny is
only set on Domain Administrators, Machine Account is
added)

Disable User Configuration is not selected

Settings not applied are things such as Hide Desktop
Icons (Basically any settings under user configuration)
and there is no consistency whatsoever.

 

[Buz [MSFT]]

Sorry for that last post. I don't know why your issue is occurring. The
items below may help you tshoot the problem. The randomness of the issue
does make it more difficult.

823862 User Policies Are Not Applied When You Log On to a Computer That Is
http://support.microsoft.com/?id=823862

250842 Troubleshooting Group Policy Application Problems
http://support.microsoft.com/?id=250842


If the above does not help enable Userenv logging on the client, log in
verify you did not get the policies, do whatever you have to do to make the
policies apply. Repost with that Userenv.log and the name of the user
account you are testing with. Also be more specific as far as what
configured policies are not applying and see if the clients are reporting
any Userenv errors in the application event log.

221833 How to Enable User Environment Debug Logging in Retail Builds of
Windows
http://support.microsoft.com/?id=221833

Buz Brodin
MCSE NT4 / Win2K
Microsoft Enterprise Domain Support

Get Secure! - www.microsoft.com/security

This posting is provided "as is" with no warranties and confers no rights.

Please do not send e-mail directly to this alias. This alias is for
newsgroup purposes only.