GPO won't apply to PC on domain

  • Thread starter Thread starter shane.williford
  • Start date Start date
S

shane.williford

I'm trying to figure out why one of my PCs won't apply any GPOs. Let me
say that it did initially have a GPO applied to it and worked as it was
designed. But for some reason, this PC now locks up after about 10
minutes (probably due to Screensaver settings) and I need to fix that.
My issue is this: the GPO that was linked to it pretty much disabled
everything because its use is for the public to access only their
accounts (this is at a financial institution). Everything was o.k. on
this PC but then at some point the Windows lockout message would be
displayed, thus members couldn't use this PC (due to obviously not
having the pwd - btw, this PC autologs-on as well). The problem in
changing this is 1) Going into Display settings is disabled because of
GPO; 2) I removed this PC from its original OU so it could now have the
Default Domain GPO applied so I could look at the display settings, but
this in lies where I'm having trouble....this PC doesn't apply any
other GPOs....it just seems to retain its original GPO. I'm unable to
"force" GP on this as again, this ability has been disabled (i.e. no
"Run" option under Start and no "CMD" prompt). Keep in mind, this PC
has pretty much NOTHING that can be accessed due to the GPO applied to
it. For obvious reasons (it's accessed by the public), it's locked down
pretty much as much as it can be.

So, after all this, my question is this....how can I get this PC to its
default (OS install) state without having to rebuild it or, is it that
the registry is so manipulated because of the GPO that was applied that
a rebuild is pretty much what I have to do?

Thanks for any information given!
Shane
 
Many GPO settings must be reversed. For instance (and I'm not at all sure
this is one of them, but...) if you create a policy that removes the run
command from the start menu, you can't just delete the GPO. You must either
modify the GPO to NOT remove it , or create a new one that un-does the
previous setting.

....kurt
 
Hi,

Run RSOP against this machine and look for the settings that are
causing you this issue. Like Kurt mentioned, you probably have
tattooed the registry by just removing the group policy and not
"undoing" what was set.
Once you have determined the settings you have to change, create a new
policy and set those particular settings to disabled NOT not defined.
Not defined means just that, but if the setting is already set, it will
not change it unless you "undo" it with changing the setting to
disabled.

Hope this helps

Harj Singh
Power Your Active Directory Investment
www.specopssoft.com
 
Back
Top