Member Avatar for hazzag1995

I have just set up a server at a local youth club, im fairly new to networking, although i do know alot considering i only started in july. I have set up ADDS on a windows Server 2008 R1 (vista) machine, i have loaded so far, 5 client PC's to the domain, all running Windows 7 Pro. I need to lock an account down, and i made a group policy outlining what i want blocked and whats ok to access, and ive added the users, and the computer to the GP so it should go through, but it isnt. All DNS settigns are correct, i can log in to the account but no restrictions have been applied. I tried using the "gpupdate /force" command in CMD, and that said the policies had updated successfully, but nothing has gone through. Ive logged out and logged in, plus restarts countless times but still nothing is going through and i need help with it. I should note that Windows Server 2008 R1 has a very different GP managament system to Windows Server 2008 R2. Thanks in Advance.

  • 3 Contributors
  • 5 Replies
  • 382 Views
  • 2 Weeks Discussion Span
  • Latest Post Latest Post by hazzag1995

Dani AI

Generated

Nice to see it got fixed — good job . For future readers who land here with the same symptom (GPOs that appear to update but no settings take effect), the following focused troubleshooting and safe fixes add to what and suggested.

Common diagnostic checklist (quick and focused)

  • Produce a client-side policy report so you can see which GPOs were applied and which were denied.
  • Inspect the Group Policy operational event log on the client for errors from CSEs or permission problems.
  • Verify GPO scope: security filtering, group membership, any WMI filters, and the link order/enforcement on the OU where the objects live. Make sure the target account or group actually has Read + Apply rights on the GPO.
  • Confirm SYSVOL/NETLOGON accessibility from the client and that GPO files have replicated to all domain controllers; missing files or ACLs on SYSVOL often block processing.
  • If user settings are supposed to follow a machine context (or vice versa), check loopback processing and local policy overrides.

Quick commands to generate evidence (run as admin on the client or DC)

gpresult /h gp-report.html
rsop.msc
dcdiag /v

Save and review the HTML/report and the GroupPolicy operational log before making changes.

Practical tips and cautions

  • Use a test user and test workstation in the same OU to iterate safely.
  • If security filtering was tightened for delegation, remember Deny entries will prevent application even if the GPO is linked.
  • Prefer Group Policy Preferences for mapped drives and many common desktop tweaks; they are easier to debug than complex scripts.

This set of steps usually reveals whether the issue is scope/permissions, replication, client-side errors, or policy conflicts — and points directly to the specific fix.

Recommended Answers

All 5 Replies

Member Avatar for CimmerianX

Did you run the GP modeling wizard on the server for thie user and workstation? What did results show. Are your changes applied?

Also, what 'restrictions' are you implementing?

Member Avatar for hazzag1995

I dont think so. All i did is create a GP, and told it which users and computers for it to apply to, expecting them to be applied when the user logs on or the PC restarts. The restrictions are so users cannot access control panel items, i need certain drives mapped on the server storage drive. Other little things like setting specific dekstop wallpapers, logon messages, not having access to system tools, eg task manager, N&S center, regedit that kinda stuff. Thanks for the quick reply.

Member Avatar for JorgeM

Some things to note since you are new to AD. With regard to GPOs as you have seen they are made up of user and computer settings. The user settings apply to user objects and the computer settings apply to computer objects. So when you link the GPO to an OU there must be user and/or computer objects in that OU so that the user settings apply to the user objects and the computer settings apply to computer objects. Also note that objects in the default user and computers containers do not inherit the GPO settings.

Member Avatar for hazzag1995

Yea that does make sense, i have made custom users, not default, but i have left them in t6he default "Users" OU, rather than creating my own and linking the GPO to the other OU.

Member Avatar for hazzag1995

good news! I got it working! thanks for the tips guys:)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.