Change IP Address

[cluberti]

How about this - create a local non-admin, non-domain user on the machine and attempt to change network settings. Does it work? Does it work if you change a domain user's profile to local rather than roaming? If you remove and re-add the machine to the domain, does it work then?

[Hamins]

hmmm... I have'nt tried that. Lemme try it out on Monday, and get back. Thanks

[Ctrl-X]

What cluberti means is: remove a test computer from the domain by joining it to an existing or a new workgroup. Create a local user account and make it a member of the Network Configuration Operators group. Log on using that user account and see if you can change the IP address. If you can, then the problem is caused by one of the domain policies.

[Hamins]

Hi Ctrl-X/Cluberti,

I tried what Cluberti suggested. I removed a workstation off the Domain, and created a local user on that PC, and assigned that user to the Network Configuration Operator's group. It worked - The user had access to change network settings.

So, yes, the problem seems to be with the Domain based Group Policies. I had this feeling even b4 I performed the above excersize. However, the question is which policy setting is causing this problem.

[cluberti]

Well, best to create a new OU and apply policies to the machine one at a time (removing from the domain after each policy change, to make sure the policies are clean). One will trigger it, so good luck.

[Hamins]

Please ... pretty please, somebody give a solution to this .... I've tried everything you'll have suggested, but so far nothing has worked..... I need to get this solved, at the earliest .....

[cluberti]

You've created a new OU, placed this one and only machine in that new OU, linked policies to this OU one at a time, and you still don't know which one is causing this?

[Stoic Joker]

Just out of curiosity...

After the GP changes are you doing a policy refresh on the server & client? [gpupdate /force] If not the policy changes won't go into/be in effect till the next refresh interval (approx 90min).

After user group membership changes, are you doing a logoff/logon so a new security access token can be generated reflection this change?

Just a thought

Stoic Joker