GP do not take effect

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

We have two Windows 2000 SP4 domain controllers with Widnows 2000 and
Windows XP users. We have never applied GP before and last week when we try
to apply the password policy for 90 days etc., it is not taking effect. While
applying GP, we removed all the previous policies which was default policies.
We have also created special OU to try out the GP and also one Sub-OU to
check the block policy inheritance.

We have removed "password never expires" from AD users and computers after
we applied poilcy but still not effect on users.

Does anyone has any idea what we need to do so that GP applies for password
policy? It looks like that it is not taking any settings but when we check
local PC
even logs, it says that Group policy applied successfully. When I check in
SysVol folder on DC, I see many policy folders [with long digists] which is
even five years old in time stamp !!! Is this a problem? I see no problem in
replication between domain controllers and no errors on DCs.

Any idea?
 
applying GP, we removed all the previous policies which was default
policies.
We have also created special OU to try out the GP and also one Sub-OU to
check the block policy inheritance.
Click to expand...

Account policies applied at the OU level only take effect when a user logs
on locally to a computer in that OU. Account (password) policies should be
applied at the domain level.

hth
DDS


Rajesh said:
We have two Windows 2000 SP4 domain controllers with Widnows 2000 and
Windows XP users. We have never applied GP before and last week when we
try
to apply the password policy for 90 days etc., it is not taking effect.
While
applying GP, we removed all the previous policies which was default
policies.
We have also created special OU to try out the GP and also one Sub-OU to
check the block policy inheritance.

We have removed "password never expires" from AD users and computers after
we applied poilcy but still not effect on users.

Does anyone has any idea what we need to do so that GP applies for
password
policy? It looks like that it is not taking any settings but when we check
local PC
even logs, it says that Group policy applied successfully. When I check in
SysVol folder on DC, I see many policy folders [with long digists] which
is
even five years old in time stamp !!! Is this a problem? I see no problem
in
replication between domain controllers and no errors on DCs.

Any idea?
Click to expand...
 
We have already applied the GP at the domain level but still no effect. Even
for the test OU, it does not apply policy.

Let me know what to do next.

Danny Sanders said:
applying GP, we removed all the previous policies which was default
policies.
We have also created special OU to try out the GP and also one Sub-OU to
check the block policy inheritance.
Click to expand...

Account policies applied at the OU level only take effect when a user logs
on locally to a computer in that OU. Account (password) policies should be
applied at the domain level.

hth
DDS


Rajesh said:
We have two Windows 2000 SP4 domain controllers with Widnows 2000 and
Windows XP users. We have never applied GP before and last week when we
try
to apply the password policy for 90 days etc., it is not taking effect.
While
applying GP, we removed all the previous policies which was default
policies.
We have also created special OU to try out the GP and also one Sub-OU to
check the block policy inheritance.

We have removed "password never expires" from AD users and computers after
we applied poilcy but still not effect on users.

Does anyone has any idea what we need to do so that GP applies for
password
policy? It looks like that it is not taking any settings but when we check
local PC
even logs, it says that Group policy applied successfully. When I check in
SysVol folder on DC, I see many policy folders [with long digists] which
is
even five years old in time stamp !!! Is this a problem? I see no problem
in
replication between domain controllers and no errors on DCs.

Any idea?
Click to expand...
Click to expand...
 
TO set up a group policy see:
http://technet2.microsoft.com/windo...b53d-41d0-9867-199f6595a01b1033.mspx?mfr=true

hth
DDS



Rajesh said:
We have already applied the GP at the domain level but still no effect.
Even
for the test OU, it does not apply policy.

Let me know what to do next.

Danny Sanders said:
applying GP, we removed all the previous policies which was default
policies.
We have also created special OU to try out the GP and also one Sub-OU
to
check the block policy inheritance.
Click to expand...

Account policies applied at the OU level only take effect when a user
logs
on locally to a computer in that OU. Account (password) policies should
be
applied at the domain level.

hth
DDS


Rajesh said:
We have two Windows 2000 SP4 domain controllers with Widnows 2000 and
Windows XP users. We have never applied GP before and last week when we
try
to apply the password policy for 90 days etc., it is not taking effect.
While
applying GP, we removed all the previous policies which was default
policies.
We have also created special OU to try out the GP and also one Sub-OU
to
check the block policy inheritance.

We have removed "password never expires" from AD users and computers
after
we applied poilcy but still not effect on users.

Does anyone has any idea what we need to do so that GP applies for
password
policy? It looks like that it is not taking any settings but when we
check
local PC
even logs, it says that Group policy applied successfully. When I check
in
SysVol folder on DC, I see many policy folders [with long digists]
which
is
even five years old in time stamp !!! Is this a problem? I see no
problem
in
replication between domain controllers and no errors on DCs.

Any idea?
Click to expand...
Click to expand...
Click to expand...
 
"password never expires" is not controlled by GP
That per-account setting allows exemption from GP delivered account settings
related to password expiration. It is commonly used for service accounts.

I am concerned at what might underlie your statement that you "removed all
the
previous policies which was default policies" as many of those settings in
the
two default GPOs you probably do want.

Roger
 
Back
Top