No domain or Organizational Unit policies applied to clients...

[Guest]

I am running Windows 2000 Server with Windows XP clients(clients up to service pack 1). Everything is running fine(I can authenticate in Active Directory, apply polices to users, etc...), except for the computer policies to be applied to my clients. The problem is that the computer policies do not get displayed. In the event viewer of the clients I recieve the error Source Userenv, Type Error, Description Windows cannot query for the list of Group Policy objects. A message that describes the reason for this was previously logged by the policy engine.

Question is what is preventing my domain or organizational unit policies from being applied, and where can I see this "reason for this was previously logged by the policy engine"

Thanks

 

[Cary Shultz [MVP]]

-----Original Message-----
I am running Windows 2000 Server with Windows XP clients

(clients up to service pack 1). Everything is running
fine(I can authenticate in Active Directory, apply
polices to users, etc...), except for the computer
policies to be applied to my clients. The problem is
that the computer policies do not get displayed. In the
event viewer of the clients I recieve the error Source
Userenv, Type Error, Description Windows cannot query for
the list of Group Policy objects. A message that
describes the reason for this was previously logged by
the policy engine.

Question is what is preventing my domain or

organizational unit policies from being applied, and
where can I see this "reason for this was previously
logged by the policy engine"

Thanks

.

I would typically answer this question with a "DNS"
response. That is usually the problem ( or at least
somehow involved ).

Can you give us an example of a computer policy?
Remember, normally speaking the computers need to be in
an OU ( not a container ), the GPO needs to be linked to
that OU ( or multiple OUs ) and the computer objects need
to have the "Read" and "Apply Group Policy" rights (
often times "Domain Computers" is a good Group to use -
essentially you would replace "Authenticated Users"
with "Domain Computers" ). This is filtering. You might
want to be careful with this.

Also, can you verify that perhaps the "computer
configuration" side of the GPO has not been disabled?

Have you tried any of the utilities like GPOTOOLS or
GPRESULT or the GPMC? This might be a start! And what
are the event ids that you mentioned?

HTH,

Cary

 

[Guest]

A computer policy that I have tried is something simple like the "message text for users attempting to logon" my policy is not applied only the local computer policies are applied. The event ID would be 1030. My computer object is in an OU and it is part of the "Domain Computers" group. And I verified that it has enabled "read" and apply group policy rights. I have not tried any group policy tools yet, are they third party where can I recieve them? I have also just tried the hotfix for the known problem from Microsoft Article ID "810907" without success. And what is meant with a DNS problem? Could you be more detailed, because I have the client manually configured to go to the correct DNS server.


Thanks

 

[Guest]

I can also verify that the "computer configuration" side of the GPO has not been disabled

Just trying to give as much information as needed to make troubleshooting easier,

Thanks again

 

[Cary Shultz [MVP]]

-----Original Message-----
I can also verify that the "computer configuration" side

of the GPO has not been disabled

Just trying to give as much information as needed to make troubleshooting easier,

Thanks again

.

DNS is a big part of WIN2000. There is something called
an SRV record that is all important within DNS. When
someone has a problem with WIN2000 I tend to look at DNS
first. And with Group Policy if DNS is not correct then
the Group Policy will not work properly. So, based on
the symptoms you described I initially thought about DNS.
But it was just an initial thought.

Take a look at the following link:
http://www.eventid.net/display.asp?eventid=1030&source=

It might help you. The first two tools are part of the
Resource Kit. You should be able to go to the MS Web
Site and download them individually. The third tool (
GPMC ) is realitively new. It can be downloaded from the
MS Web Site, as well. Sorry that I do not have the links
right now.

Cary

 

[Guest]

Thanks Carey for your help, it was a combination of different problems such as the DNS as you were referring to and the acutal machine build, but in the end I did get it to work.

Thanks again,

Mike