Active Directory Group policy and XP

[ammad]

Dear all,

i configured software restriction policy on windows 2003 R2 Domain. there are several OU. the problem is " Policy is working on 80% of windows xp sp2 computer " where as only 20 % of windows xp sp2 stoping users from runing these (MSN, Yahoo, ) softwares.

My understanding is "local system policy" is overriding domain(OU) policy). if i am right than how do i override it. or how do i force Group policy on these systems.

i have forced the AD plicy using "gpupdate /force" , and restarted workstations + domain controller. still no success .

Any idea to solve this problem .

thanks.

[IcemanND]

Group policy works from the top down. Any policy applied at an OU will apply to all objects in that OU and sub-OU's unless inheritance is blocked in the a sub-OU.

The machines that are not getting the policies, do the policies show up when you run gpresult? are they in the same Ou as machines that work? Any errors in the event logs concerning group policies? Are they on the same subnet as working machines?

[Tripredacus]

What gets authority, users over computers? Perhaps these 20% have users that over-ride the computer policy?

[ammad]

but MSN/Yahoo blocked is working for some users in same OU and reset are able to run these softwares. ..

how do i rung gpresult ,.

thanks for response.

[IcemanND]

open CMD window and type gpresult. if you want more information you can use the /v switch for verbose logging. But be sure to make the CMD window's buffer size larger first as the verbose report is larger than what will fit. You can use verbose /? to get all of the options.