Can't get GPO to propagate to clients!

  • Thread starter Thread starter JAMES
  • Start date Start date
I guess I'm not sure how to answer that. Where would I check this?

I did run GPResult on the client machines, and they claim to have the latest
GPO from the server, but they're not doing what I want.
 
Run the "secedit /refreshpolicy" command from command
prompt...... if that fails to correct the problem, you
might want to work with one workstation and remove it from
and rejoin the domain.
 
Check http://support.microsoft.com/default.aspx?scid=kb;en-
us;227302

You can use Secedit.exe with the /REFRESHPOLICY switch to
impose group policy object settings upon a target
workstation immediately as follows:

SECEDIT /REFRESHPOLICY MACHINE_POLICY /ENFORCE:
Immediately imposes group policy object settings located
within the "machine" node of relevant group policy objects.
SECEDIT /REFRESHPOLICY USER_POLICY /ENFORCE: Immediate
imposes group policy object settings located within
the "User" node of the relevant group policy objects.


James
 
Okay, I'm very confused now. I did the secedit thing as outlined below (by
the way, should that be done on the workstation, the server, or both - I did
it on both). I've also tried unjoining and rejoining the domain, AND just
for kicks, I renamed the Group Policy to something other than Default Domain
Policy AND deleted the link to the Default Policy.

So why, then, on my client, does GPResult still show that I'm inheriting
from Default Domain Policy???
 
did you try to clear the DNS cache entries?
Also, your inheritance box is ticked, so inheritance is
propagated.
 
Don,

The "Access Control Settings" on your Security Management
Console via MMC, on Permissions tab has the
Allow inheritable permissions from parent to propagate to
this object check off box.

I have some time this thursday am EST, if you have not
resolved this problem, drop me mail Wednesday night, and I
can help you walk-through this problem. When you drop me e-
mail include your contact numbers.

Regards,
James Lorenzana
(e-mail address removed)
 
Okay, I'm very confused now. I did the secedit thing as outlined below (by
the way, should that be done on the workstation, the server, or both - I did
it on both). I've also tried unjoining and rejoining the domain, AND just
for kicks, I renamed the Group Policy to something other than Default Domain
Policy AND deleted the link to the Default Policy.

So why, then, on my client, does GPResult still show that I'm inheriting
from Default Domain Policy???
Click to expand...
You can't delete the Default Domain Policy. It must still know that
the renamed policy is the Default Domain Policy.

Cheers,

Cliff
 
Back
Top