1

Hi!

I am just getting started with Group Policies (because they are awesome) but I am having what I’m sure is a newbie issue. I have the feature installed (2012 R2 Server) and I can go in and make policies, but they aren’t actually doing anything. For example, I made a policy to lock computers after being idle for 10 minutes but it doesn’t actually take on the computers. I know it does take time for them to pickup the new policy, but this was last week and it is still not working. I did notice that under the default domain policy it has the actual domain listed where it says things that are linked to this GPO, but I can’t seem to get that to appear in any of the other ones I’ve made. Let me know if you need any more info. Thanks!

3 Spice ups
2

The GPOs have to be linked to an OU for them to take affect. Might be good to start here: Group Policy for Beginners | Microsoft Learn

4 Spice ups
3

You need to make sure that the policy is attached to an Organizational Unit (OU), and that the computers / users that it should apply to are all in that OU, preferably in sub-OUs. You should never apply a GPO to an entire domain, it causes extremely weird and unexpected things to happen.

To force the policy to start taking effect on a workstation immediately, follow these steps on that workstation:

  1. Open a command prompt

  2. type GPUPDATE

  3. Hit enter

  4. Reboot

That will force the new policy to go into effect.

3 Spice ups
4

In Group Policy Management, you’ll need to link the GPO to the appropriate OUs. (Right click the OU and "Link an existing group policy)

I also believe policies don’t apply If you have your computers in the ‘computers’ CN container and your users in the ‘users’ CN; you’ll need to have them in real OUs.

Also, be careful how you link; you don’t necessarily want to apply lock-down policies to your DCs.

This link might be helpful: Archived MSDN and TechNet Blogs | Microsoft Learn

2 Spice ups
5

Also BEST PRACTICE is not to modify the default policy or domain controller policy. leave those as is and create new gpo’s for whatever else you need done to the network.

2 Spice ups
6

Thanks for the links! I’m working on setting up the WSUS for my company and really need to get this down. If you have any suggestions on best practices for something like this that would be massively helpful as well. If I’m going to do it, I might as well do it right.

7

Here’s a link with step-by-step for WSUS with a GPO example.