Please help, "security settings" in GPO for default domain policy does not get processed

  • Thread starter Thread starter jacques koorts
  • Start date Start date
J

jacques koorts

Hi, I have run out of ideas why this does not work.

I've added registry settings in "security settings">registry. Went to client
and run secedit and even rebooted, but no effect on client - the entries
does not get written.

gpresult produces no clues.

I went and changed account policies - same problem, does not processed and
gpresult says nothing.

I went and add a script to "windows settings">scripts, that worked, and
gpresult did report on it.

I went and made some changes in "Administrative templates>Windows
components>Windows Update". This does get processed, and my clients updates
nicely from SUS. GPresult shows that this gets processed.

What the hell is wrong?!

Any suggestions anyone?

The keys I want to add is (I'm pasting from my .reg file) is:

[HKEY_CLASSES_ROOT\jkAD.WSC]
@="jkAD"

[HKEY_CLASSES_ROOT\jkAD.WSC\CLSID]
@="{30FD2C9B-F4B4-4948-B18B-95986FC055D3}"

Here my gpresult:

Microsoft (R) Windows (R) 2000 Operating System Group Policy Result tool
Copyright (C) Microsoft Corp. 1981-1999


Created on Wednesday, July 07, 2004 at 4:25:02 PM


Operating System Information:

Operating System Type: Professional
Operating System Version: 5.0.2195.Service Pack 4
Terminal Server Mode: Not supported

###############################################################

User Group Policy results for:

CN=reception,OU=frontdesk,DC=tbh,DC=com

Domain Name: TBH
Domain Type: Windows 2000
Site Name: Default-First-Site

Roaming profile: \\file-tbh\reception$\profile
Local profile: C:\Documents and Settings\reception

The user is a member of the following security groups:

TBH\Domain Users
\Everyone
BUILTIN\Users
NT AUTHORITY\INTERACTIVE
NT AUTHORITY\Authenticated Users
\LOCAL
TBH\FrontDesk

The user has the following security privileges:

Bypass traverse checking
Shut down the system
Remove computer from docking station


###############################################################

Last time Group Policy was applied: Wednesday, July 07, 2004 at 4:24:08 PM
Group Policy was applied from: file-tbh.tbh.com


===============================================================
The user received "Internet Explorer Branding" settings from these GPOs:

Default Domain Policy
Revision Number: 2
Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
Domain Name: tbh.com
Linked to: Domain (DC=tbh,DC=com)


Additional information is not available for this type of policy setting.



###############################################################

Computer Group Policy results for:

CN=FRONTDESK4,CN=Computers,DC=tbh,DC=com

Domain Name: TBH
Domain Type: Windows 2000
Site Name: Default-First-Site


The computer is a member of the following security groups:

BUILTIN\Administrators
\Everyone
BUILTIN\Users
TBH\FRONTDESK4$
TBH\Domain Computers
NT AUTHORITY\NETWORK
NT AUTHORITY\Authenticated Users

###############################################################

Last time Group Policy was applied: Wednesday, July 07, 2004 at 4:23:37 PM
Group Policy was applied from: file-tbh.tbh.com


===============================================================


The computer received "Registry" settings from these GPOs:

Local Group Policy
Revision Number: 3
Unique Name: Local Group Policy
Domain Name:
Linked to: Local computer

Default Domain Policy
Revision Number: 29
Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
Domain Name: tbh.com
Linked to: Domain (DC=tbh,DC=com)




The following settings were applied from: Local Group Policy

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS
ValueName: EFSBlob
ValueType: REG_BINARY
Value: Binary data. Use the /S switch to display.

KeyName:
Software\Policies\Microsoft\SystemCertificates\EFS\Certificates\92992C8905B8
24FF11F7E7D7EB6E1F3FDFEA5C67
ValueName: Blob
ValueType: REG_BINARY
Value: Binary data. Use the /S switch to display.

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CRLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CTLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values


The following settings were applied from: Default Domain Policy

KeyName: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
ValueName: NoWelcomeScreen
ValueType: REG_DWORD
Value: 0x00000001

KeyName:
Software\Policies\Microsoft\SystemCertificates\ACRS\Certificates
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\ACRS\CRLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\ACRS\CTLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS
ValueName: EFSBlob
ValueType: REG_BINARY
Value: Binary data. Use the /S switch to display.

KeyName:
Software\Policies\Microsoft\SystemCertificates\EFS\Certificates\E4EC6490BDFC
BDD767193E83B5F243689F4A545B
ValueName: Blob
ValueType: REG_BINARY
Value: Binary data. Use the /S switch to display.

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CRLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CTLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName:
Software\Policies\Microsoft\SystemCertificates\Root\Certificates
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\Root\CRLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\Root\CTLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName:
Software\Policies\Microsoft\SystemCertificates\Trust\Certificates
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\Trust\CRLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\Trust\CTLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\Windows\Group
Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
ValueName: NoBackgroundPolicy
ValueType: REG_DWORD
Value: 0x00000000

KeyName: Software\Policies\Microsoft\Windows\Group
Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
ValueName: NoGPOListChanges
ValueType: REG_DWORD
Value: 0x00000000

KeyName: Software\Policies\Microsoft\Windows\System
ValueName: AddAdminGroupToRUP
ValueType: REG_DWORD
Value: 0x00000001

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate
ValueName: WUServer
ValueType: REG_SZ
Value: http://file-tbh

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate
ValueName: WUStatusServer
ValueType: REG_SZ
Value: http://file-tbh

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: RescheduleWaitTime
ValueType: REG_DWORD
Value: 0x00000005

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: NoAutoRebootWithLoggedOnUsers
ValueType: REG_DWORD
Value: 0x00000001

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: NoAutoUpdate
ValueType: REG_DWORD
Value: 0x00000000

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: AUOptions
ValueType: REG_DWORD
Value: 0x00000004

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: ScheduledInstallDay
ValueType: REG_DWORD
Value: 0x00000000

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: ScheduledInstallTime
ValueType: REG_DWORD
Value: 0x0000000f

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: UseWUServer
ValueType: REG_DWORD
Value: 0x00000001


===============================================================
The computer received "Scripts" settings from these GPOs:

Default Domain Policy
Revision Number: 29
Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
Domain Name: tbh.com
Linked to: Domain (DC=tbh,DC=com)


Startup scripts specified in: Default Domain Policy
login.vbs


===============================================================
The computer received "Security" settings from these GPOs:

Local Group Policy
Revision Number: 3
Unique Name: Local Group Policy
Domain Name:
Linked to: Local computer

Default Domain Policy
Revision Number: 29
Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
Domain Name: tbh.com
Linked to: Domain (DC=tbh,DC=com)


Run the Security Configuration Editor for more information.


===============================================================
The computer received "EFS recovery" settings from these GPOs:

Local Group Policy
Revision Number: 3
Unique Name: Local Group Policy
Domain Name:
Linked to: Local computer

Default Domain Policy
Revision Number: 29
Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
Domain Name: TBH.COM
Linked to: Domain (DC=tbh,DC=com)


Additional information is not available for this type of policy setting.
 
jesus christ.

after millions of hours trying to figure this one out, i got the problem.
YOU CANNOT CREATE REGISTRY KEYS THIS WAY.

YOU NEED TO MAKE ADM FILES

jacques koorts said:
Hi, I have run out of ideas why this does not work.

I've added registry settings in "security settings">registry. Went to client
and run secedit and even rebooted, but no effect on client - the entries
does not get written.

gpresult produces no clues.

I went and changed account policies - same problem, does not processed and
gpresult says nothing.

I went and add a script to "windows settings">scripts, that worked, and
gpresult did report on it.

I went and made some changes in "Administrative templates>Windows
components>Windows Update". This does get processed, and my clients updates
nicely from SUS. GPresult shows that this gets processed.

What the hell is wrong?!

Any suggestions anyone?

The keys I want to add is (I'm pasting from my .reg file) is:

[HKEY_CLASSES_ROOT\jkAD.WSC]
@="jkAD"

[HKEY_CLASSES_ROOT\jkAD.WSC\CLSID]
@="{30FD2C9B-F4B4-4948-B18B-95986FC055D3}"

Here my gpresult:

Microsoft (R) Windows (R) 2000 Operating System Group Policy Result tool
Copyright (C) Microsoft Corp. 1981-1999


Created on Wednesday, July 07, 2004 at 4:25:02 PM


Operating System Information:

Operating System Type: Professional
Operating System Version: 5.0.2195.Service Pack 4
Terminal Server Mode: Not supported

###############################################################

User Group Policy results for:

CN=reception,OU=frontdesk,DC=tbh,DC=com

Domain Name: TBH
Domain Type: Windows 2000
Site Name: Default-First-Site

Roaming profile: \\file-tbh\reception$\profile
Local profile: C:\Documents and Settings\reception

The user is a member of the following security groups:

TBH\Domain Users
\Everyone
BUILTIN\Users
NT AUTHORITY\INTERACTIVE
NT AUTHORITY\Authenticated Users
\LOCAL
TBH\FrontDesk

The user has the following security privileges:

Bypass traverse checking
Shut down the system
Remove computer from docking station


###############################################################

Last time Group Policy was applied: Wednesday, July 07, 2004 at 4:24:08 PM
Group Policy was applied from: file-tbh.tbh.com


===============================================================
The user received "Internet Explorer Branding" settings from these GPOs:

Default Domain Policy
Revision Number: 2
Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
Domain Name: tbh.com
Linked to: Domain (DC=tbh,DC=com)


Additional information is not available for this type of policy setting.



###############################################################

Computer Group Policy results for:

CN=FRONTDESK4,CN=Computers,DC=tbh,DC=com

Domain Name: TBH
Domain Type: Windows 2000
Site Name: Default-First-Site


The computer is a member of the following security groups:

BUILTIN\Administrators
\Everyone
BUILTIN\Users
TBH\FRONTDESK4$
TBH\Domain Computers
NT AUTHORITY\NETWORK
NT AUTHORITY\Authenticated Users

###############################################################

Last time Group Policy was applied: Wednesday, July 07, 2004 at 4:23:37 PM
Group Policy was applied from: file-tbh.tbh.com


===============================================================


The computer received "Registry" settings from these GPOs:

Local Group Policy
Revision Number: 3
Unique Name: Local Group Policy
Domain Name:
Linked to: Local computer

Default Domain Policy
Revision Number: 29
Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
Domain Name: tbh.com
Linked to: Domain (DC=tbh,DC=com)




The following settings were applied from: Local Group Policy

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS
ValueName: EFSBlob
ValueType: REG_BINARY
Value: Binary data. Use the /S switch to display.

KeyName:
Software\Policies\Microsoft\SystemCertificates\EFS\Certificates\92992C8905B8
24FF11F7E7D7EB6E1F3FDFEA5C67
ValueName: Blob
ValueType: REG_BINARY
Value: Binary data. Use the /S switch to display.

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CRLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CTLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values


The following settings were applied from: Default Domain Policy

KeyName: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
ValueName: NoWelcomeScreen
ValueType: REG_DWORD
Value: 0x00000001

KeyName:
Software\Policies\Microsoft\SystemCertificates\ACRS\Certificates
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\ACRS\CRLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\ACRS\CTLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS
ValueName: EFSBlob
ValueType: REG_BINARY
Value: Binary data. Use the /S switch to display.

KeyName:
Software\Policies\Microsoft\SystemCertificates\EFS\Certificates\E4EC6490BDFC
BDD767193E83B5F243689F4A545B
ValueName: Blob
ValueType: REG_BINARY
Value: Binary data. Use the /S switch to display.

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CRLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\EFS\CTLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName:
Software\Policies\Microsoft\SystemCertificates\Root\Certificates
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\Root\CRLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\Root\CTLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName:
Software\Policies\Microsoft\SystemCertificates\Trust\Certificates
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\Trust\CRLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\SystemCertificates\Trust\CTLs
ValueName:
ValueType: REG_NONE
Value: This key contains no values

KeyName: Software\Policies\Microsoft\Windows\Group
Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
ValueName: NoBackgroundPolicy
ValueType: REG_DWORD
Value: 0x00000000

KeyName: Software\Policies\Microsoft\Windows\Group
Policy\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}
ValueName: NoGPOListChanges
ValueType: REG_DWORD
Value: 0x00000000

KeyName: Software\Policies\Microsoft\Windows\System
ValueName: AddAdminGroupToRUP
ValueType: REG_DWORD
Value: 0x00000001

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate
ValueName: WUServer
ValueType: REG_SZ
Value: http://file-tbh

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate
ValueName: WUStatusServer
ValueType: REG_SZ
Value: http://file-tbh

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: RescheduleWaitTime
ValueType: REG_DWORD
Value: 0x00000005

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: NoAutoRebootWithLoggedOnUsers
ValueType: REG_DWORD
Value: 0x00000001

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: NoAutoUpdate
ValueType: REG_DWORD
Value: 0x00000000

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: AUOptions
ValueType: REG_DWORD
Value: 0x00000004

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: ScheduledInstallDay
ValueType: REG_DWORD
Value: 0x00000000

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: ScheduledInstallTime
ValueType: REG_DWORD
Value: 0x0000000f

KeyName: Software\Policies\Microsoft\Windows\WindowsUpdate\AU
ValueName: UseWUServer
ValueType: REG_DWORD
Value: 0x00000001


===============================================================
The computer received "Scripts" settings from these GPOs:

Default Domain Policy
Revision Number: 29
Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
Domain Name: tbh.com
Linked to: Domain (DC=tbh,DC=com)


Startup scripts specified in: Default Domain Policy
login.vbs


===============================================================
The computer received "Security" settings from these GPOs:

Local Group Policy
Revision Number: 3
Unique Name: Local Group Policy
Domain Name:
Linked to: Local computer

Default Domain Policy
Revision Number: 29
Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
Domain Name: tbh.com
Linked to: Domain (DC=tbh,DC=com)


Run the Security Configuration Editor for more information.


===============================================================
The computer received "EFS recovery" settings from these GPOs:

Local Group Policy
Revision Number: 3
Unique Name: Local Group Policy
Domain Name:
Linked to: Local computer

Default Domain Policy
Revision Number: 29
Unique Name: {31B2F340-016D-11D2-945F-00C04FB984F9}
Domain Name: TBH.COM
Linked to: Domain (DC=tbh,DC=com)


Additional information is not available for this type of policy setting.
Click to expand...
 
Back
Top