Policy settings not working/ logon time

[Dell and Rodney]

Sorry yet another set of questions................

1. Ive created my OU then placed my test user into that OU and logged onto my domain with the test user but the policy i applied didnt work - what did i do wrong?

2. When i log onto my domain with the test account it take about 5 minutes to login - how could i reduce this time?

Cheers everyone

[un4given1]

What policy are you trying to set? That would allow me to help you a little more.

[Dell and Rodney]

ok the policy that i set just to test this out was as follows -

I first created my user and group, then my OU. Right click my OU and select properties the select new from the Group Policy and name my poicy.

Went to the user section (towards the bottom of the group policy editor) and expanded a few nodes until i found Internet Explorer.

To test it out i changed the General tab etc to be disabled (along with the other tabs that you will find in internet options)

I logged on with my test user on my domain and noticed that the settings did not take effect AND each time i logged on it takes about 5 minutes to log on

Cheers

[un4given1]

Try it as a Computer setting instead of a User setting. See if that works for you. Remember that in order for that policy to be used you would have to log that user off and back on to pull the new policy.

[valter]

ok the policy that i set just to test this out was as follows -

I first created my user and group, then my OU. Right click my OU and select properties the select new from the Group Policy and name my poicy.

Went to the user section (towards the bottom of the group policy editor) and expanded a few nodes until i found Internet Explorer.

To test it out i changed the General tab etc to be disabled (along with the other tabs that you will find in internet options)

I logged on with my test user on my domain and noticed that the settings did not take effect AND each time i logged on it takes about 5 minutes to log on

Cheers

You probably have done it already but anyway, did you refresh policy settings on your domain controller?

[Dell and Rodney]

Try it as a Computer setting instead of a User setting. See if that works for you. Remember that in order for that policy to be used you would have to log that user off and back on to pull the new policy.

Yep did that already

You probably have done it already but anyway, did you refresh policy settings on your domain controller?

How do you refresh them? i have closed down the policy editor and restarted it if that any help. Currently the setting is set to disabled (for IE policy settings)

[ravashaak]

You might also want to check the permissions for the group policy object you created. It could be that the permissions are set so that the policies defined under that GPO are not applying to that user.

- Ravashaak

[Dell and Rodney]

When i craeted the the group i selected Global and security - is this correct?

[valter]

How do you refresh them? i have closed down the policy editor and restarted it if that any help. Currently the setting is set to disabled (for IE policy settings)

Windows 2000

Computer: SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE

User: SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE

Windows 2003

gpupdate

Beside this, try to find a tool gpresult.exe on the MS website, this should log all policies that applies once you logon. Excellent tool for policy trooubleshooting

Hope this helps

[Dell and Rodney]

I started over my Group Policy again and have thye same result (policy not taking affect) so i ran the gpresult on WS2003. I think the yellow highlight is where the problem is but not sure how to resolve it.......the red marks are my computer name - any ideas anyone?

Cheers

EDIT: If this is of any help it seems that ANY user i create has the same policy (even administrator account i created). In active directcory under the computer folder it lists my computer that im logging on with and not the server - is this correct?

EDIT 2: If i right click my domain and select properties shoudl my GP be listed in there?

[valter]

Well it looks like nothing hasn't been applied, at least that's what it says in the gpresult report. Anyway if your default domain security policy on certain GPO is for example set to ON, and OU GPO is set to OFF, the domain level policy will be applied, so make sure that there is no conflict between domain GPO and OU GPO (even though you SHOULDN'T change default domain policy, but only create your own new policies) ... if this doesn't work as well, there is only one thing left (without puting up a case w/ MS) reset security policies to default level. I know that there is a tool from MS that resets sec policies to default level. I don't think you can just download it, but you have to call MS support and ask them to mail it to you ...

[Dell and Rodney]

Thanks Klasika

Anyway if your default domain security policy on certain GPO is for example set to ON, and OU GPO is set to OFF, the domain level policy will be applied

How do i check to see if this seting is on/off?

there is only one thing left (without puting up a case w/ MS) reset security policies to default level. I know that there is a tool from MS that resets sec policies to default level.

Would this article reset the policies? if not do you know the name of the tool that i would ask from MS

http://support.microsoft.com/default.aspx?scid=324800

Thanks again for your help.

[valter]

Ad 1.

Open Active Directory Users and Computers, right click on your AD domain name, click Properties, click Group Policy and then click Edit on Default Domain Policy, find the policy you're trying to apply in the editor and compare it.

Ad 2.

No, the article you've post link for is how to reset user rights on GPO. (who can read and what). Can't recall the tool name (something like resetpolicydefault.exe) but if you just tell them that you want to reset your security policies to default, they'll now what you need