Windows Server 2003 Group Policy

[Zophar]

Ok. I'm just trying to do a simple exercise with Group Policy and it's just not working. Here's what I did.

1. Created a test OU
2. Set Group Policy on that OU (specifically disabled the control panel)
3. Created a user in the OU and moved my laptop computer object to the OU
4. Added my laptop to the domain
5. Logged into the domain using newly created username with laptop.

I can still get into the control panel. I know I've set the group policy right...and I've used the gpupdate command on my laptop to refresh the policy. I've rebooted...logged in and out etc... Can anyone tell my why the policy is not working when I log in with a laptop and username that's in the test OU? Shouldn't the control panel be disabled?

Any help is appreciated.

[BloodRed]

What's up man? How've you been?

If you don't already have it, grab the Group Policy Management Console and use it's Group Policy Results tool to see if the policy is actually applying to your laptop when you logon with that user account. Also, is that account an admin on the laptop?

[SkyDog]

Like BloodRed mentioned, the Group Policy Management Console (GPMC) is a great tool for working with and troubleshooting Group Policy. Using it, you can view the cumulative settings of all GPO's that would apply to your user or computer.

As for the particular policy you're working on, can you tell us which specific policy you've configured and how it's set? Sometimes they're a little bit tricky in the way you need to interpret them, like how it might seem odd to enable a policy to disable an object.

[jimmt]

You can't assign user policies to machines and vice versa.

Jim

[SkyDog]

You can't assign user policies to machines and vice versa.

But if the computer and user are in the same OU (which I think is what he's describing), both user and computer policies would apply to that particular user on that particular computer.

(It's certainly not ideal to have the users and computers in the same OU, but that's another can o' worms.)

I'm kinda wondering about the OU & domain membership because he mentioned that the computer was moved to the OU first and then added it to the domain. I'd want to verify the computer object in the OU is valid for the workstation he's using.