HELP! No GPO in effect, but restrictions still apply

[Guest]

OK, this one's REALLY strange. Please help!

Environment...

Windows 2003 Server, all critical updates applied
XP Pro SP2 desktops, all critical updates applied

Situation...

Everything was working fine from a Group Policy perspective until today. I
just added a new workstation to the domain, and upon reboot I noticed that
specific Group Policy restrictions were being applied, despite the fact that
I hadn't yet moved the workstation to an OU where I have the GPOs are
defined. More specifically, restrictions from different GPOs linked to
different OUs are being applied, despite the fact that the workstation
remains in the default "Computers" container in AD. The only GPO that should
be applied at this point is the Default Domain Policy, which is unmodified,
and contains none of the restrictions I'm seeing.

I ran gpresult on the workstation and confirmed that indeed nothing but the
Default Domain Policy is listed, yet the restrictions that are specifically
defined in the other GPOs are in effect.

I've spent hours combing through the policies and can find nothing out of
the ordinary. The Default Domain Profile definitely does not contain the
restrictions I'm seeing. I've even gone so far as to disable EVERY GPO on my
server, including the Default Domain Profile, rebooted the server, rebooted
the workstation, and still the restrictions remain in effect. Gpresult
confirms that NO Group Policy is applying whatsoever, yet the restrictions
remain in effect.

So I've asked myself "what's changed" since the OU and GPO structure was
working properly. The only thing that's different is that I ran Windows
Update on the server and I believe there were 3 critical updates this past
week. Other than that there have been no changes. No new software, no
configuration changes, nothing.

The answer is there, I just don't see it. Someone please show me the light.

 

[lforbes]

OK, this one's REALLY strange. Please help!

Environment...

Windows 2003 Server, all critical updates applied
XP Pro SP2 desktops, all critical updates applied

Situation...

Everything was working fine from a Group Policy perspective
until today. I
just added a new workstation to the domain, and upon reboot I
noticed that
specific Group Policy restrictions were being applied, despite
the fact that
I hadn't yet moved the workstation to an OU where I have the
GPOs are
defined. More specifically, restrictions from different GPOs
linked to
different OUs are being applied, despite the fact that the
workstation
remains in the default "Computers" container in AD. The only
GPO that should
be applied at this point is the Default Domain Policy, which
is unmodified,
and contains none of the restrictions I'm seeing.

I ran gpresult on the workstation and confirmed that indeed
nothing but the
Default Domain Policy is listed, yet the restrictions that are
specifically
defined in the other GPOs are in effect.

I've spent hours combing through the policies and can find
nothing out of
the ordinary. The Default Domain Profile definitely does not
contain the
restrictions I'm seeing. I've even gone so far as to disable
EVERY GPO on my
server, including the Default Domain Profile, rebooted the
server, rebooted
the workstation, and still the restrictions remain in effect.
Gpresult
confirms that NO Group Policy is applying whatsoever, yet the
restrictions
remain in effect.

So I've asked myself "what's changed" since the OU and GPO
structure was
working properly. The only thing that's different is that I
ran Windows
Update on the server and I believe there were 3 critical
updates this past
week. Other than that there have been no changes. No new
software, no
configuration changes, nothing.

The answer is there, I just don't see it. Someone please show
me the light.

Hi,

Did you check the Local Security Policy on the local machine? IF
there are settings here that don’t conflict with Group Policies then
they WILL Apply. Also, run gpedit.msc (local group policy) and see
what is there.
More than likely there is a local setting set and that is why it is
affecting this workstation.

Cheers,

Lara

 

[Guest]

Thanks Lara. No local policies are in effect, and this situation is
affecting multiple machines. New workstations, and new 2003 servers. When
they're freshly loaded, they're fine, and as soon as they join the domain the
restrictions apply, before they're moved from the default container. I'm
logging on with an unrestricted administrator account, and even created
another account to ensure there were no restrictions.

Thoughts?

 

[Guest]

SOLVED! Ugh. It was the default user profile I'd created for the domain.

 

[lforbes]

Hi,

SOLVED! Ugh. It was the default user profile I’d created for the
domain.

Yep! sometimes the simplest answers are often the right ones. That is
what I would have said. Glad to see you got it working.

Cheers,

Lara