Member Avatar for QKSTechTrainee

Hi all,

running a windows 2000 domain, with 2000 adv server on DC's and XP Pro clients.

Proxy server and home page for Internet Explorer 6 sp1 is set via group policy, but it fails to apply for new users after a change to the GPO that applies it (we wrote a new GPO and deleted the old one) The policy only fails to apply on a specific OU of machines (only difference to other machines is a machine-only GPO) and only for new users or users whose roaming profile has been deleted.

Any Group Policy experts out there care to field this one?

QKSTechTrainee

  • 2 Contributors
  • 2 Replies
  • 212 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by alc6379

Dani AI

Generated

Good troubleshooting by (and nice echo from ). For readers who hit the same symptom — IE proxy/homepage set by Internet Explorer Maintenance (IEM) that won’t stick for new/clean profiles on a subset of machines — the most common root is the IEM processing model: IEM typically applies the first time (or only when the IEM portion of the GPO changes) unless you force it to reapply. That behavior explains why only new profiles show the gap. ()

Quick confirm checklist (do these on an affected machine with a test user):

  • Run gpresult /r or rsop.msc and gpupdate /force to see which GPOs/CSEs actually applied.
  • Inspect the actual registry values the policy should set — homepage is written to HKCU\Software\Microsoft\Internet Explorer\Main\Start Page; proxy values live under HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable and ProxyServer — if the keys aren’t present you know the CSE didn’t write them. (learn.microsoft.com)

If you need deeper traces, enable user-environment debug logging (USERENV) and capture the branding log (brndlog.txt) under the user profile — that will show IEM/branding activity and timing so you can tell whether Folder Redirection/profile-creation is happening after IEM writes its values. Use the USERENV KB guidance and check the brndlog output when you reproduce the failure. (ftp.zx.net.nz)

Short-term/workaround options that have worked in practice:

  • Force synchronous logon processing so folder redirection and IEM run in the correct order (enable “Always wait for the network at computer startup and logon” / Sync foreground policy).
  • Use the “Internet Explorer Maintenance Policy Processing” options or set the NoGPOListChanges behavior so IEM re-applies even if the GPO version looks unchanged.
  • For a robust long-term fix, set homepage/proxy via Administrative Templates, registry-based policy/GPP or a logon script that writes the proxy keys after profile creation. (learn.microsoft.com)

These steps let you reproduce reliably, capture useful logs, and choose whether to change processing order or move the settings to a policy mechanism that always reapplies.

Member Avatar for QKSTechTrainee

I'm replying to my own post in case anyone else reads this and is helped - the fault is with XP SP2 machines, where Group Policy applies Internet Explorer maintenance and Folder redirection (in separate GPO's or in the same)

Read MS KB article 888254 for further info.

Just glad it wasn't us....

Member Avatar for alc6379

Excellent!

It would appear that not a lot of people know about Group Policy stuff here. I certainly know I, for one, am not as up on it as I'd like to be.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.