PLEASE HELP - Problems with GPO folder-redirection

[Mark Wood]

I have re-posted this since I haven't had a reply to the
last one yet.

Let me apologize in advance for the legnthy discription
but I don't know how else I could explain the problem.

This is my set-up: I have two Global Security groups for
each year in my school. Let's take Year 7 as an example
of the problem. For year 7, there are two groups:

'Year03'
'Year03-ie'

If a pupil is a member of 'Year03', they get the 'Pupils'
GP which restricts their access to the desktop and stops
them getting onto the internet (through the proxy
settings).

If a pupil is a member of 'Year03-ie' they get the 'Pupils-
ie' GP which is exactly the same as the other one, exept
it has the correct proxy settings to allow internet
access. So far so Good.

There is then a seperate GP called 'Docs03' that
both 'Year03' and 'Year03-ie' groups are members of which
only has the Folder Re-direction option selected. Through
this, My Documents is linked to a share called 'Year03' on
the server, and a folder is created automatically if it
does not already exist.

Here's the problem: At the moment, all year 7 students
are members of 'Year03' and not 'Year03-ie' (meaning they
don't have internet access). Therefore, when they log on,
the 'Pupils' GP is applied, and also the 'Docs03' GP.
However, when I switch a user from the 'Year03' group to
the 'Year03-ie group to allow them internet access,
the 'Pupils-ie' GP works, but the 'Docs03' GP stops
working. When they try to click on My Documents, it tells
them that this folder cannot be found, and to check the
path specified in properties. When I look in the
properties, there is no path in the box, and it is greyed
out so nothing can be put in.

Because both Groups 'Year03' and 'Year03-ie' are members
of the GP 'Docs03' I see no reason why it should stop
working, when They are changed from the one group to the
other.

Hope this makes sense!

 

[Brendon Rogers]

I just need to be clear on something - when you talk of groups, do you mean
actual security groups or OU's?

GPO's cannot be applied to a group, they can be applied to an OU then groups
can used to filter the GPO to the users and computers within that GPO.

So what you should have is your 3 GPO's (Pupils, Pupils-ie and Docs03)
should all be set at an OU above all your user accounts. Then, go into the
properties of each GPO and change the security so Read and Apply Group
Policy are no longer available for Authenticated Users. Now add in the the
appropriate group and give them Read and Apply Group Policy.

 

[Mark Wood]

Thanks for your reply.

The GPO's are linked to the 'NCTC' domain and then are
filtered by the glabal security groups within that domain.

I have actually found a work around now, but I still can't
understand what the problem was.