1

We have two laptops that we want to lock down so they can basically only view some network docs (can’t print, use cd drive, internet, etc…). I made a new GP and selected everything I need. I then went into AD and made a new OU and put the two machines in the group. I tied the GP to the group and ran a gpupdate / force. Logged off the laptop and back in and nothing happens.

I also applied the GP to a user account and logged in with it. Once I log in the GP is still not doing anything. I am not too sure what I am doing wrong or what I am missing.

This is on a 2003 Server, the laptop is XP.

3 Spice ups
2

user policies are applied on login but computer polices are applied at start up

Have you rebooted?

3

Make sure the laptop has the current version of Windows update by going to the update side manually. Also run the update for client side extensions http://www.microsoft.com/download/en/details.aspx?id=3628

We had a few stubborn machines that wouldn’t take the policies until I ran the update for the client side extensions. Policies ran fine after that.

4

You are probably trying to assign user policies to a computer or vice versa. Look in your GPO where you configured all the settings you want, do they come under the heading Computer Settings or User Settings? Anything under the Computer Settings part will only affect computer accounts (so your GPO needs to be linked to the OU where the computer accounts are) and anything under the User Settings part only affects user accounts (so the GPO needs to be linked to the OU where the users are).

Also GPOs do not affect groups - i.e if you put these computers/users in a group and then linked the GPO to the OU where the group is held that will not do anything. You can however use the Security Filtering section of the GPO to make it only apply to specified groups, but the rules I mentioned above about the user/computer needing to be in the OU (or sub OU) where the GPO is linked still apply as well.

5

Run the group policy results and group policy modeling wizards to see what isn’t being applied and why.

2 Spice ups
6

Hi all,

RCR_IT, Do one thing create a group, assign a fake user and assign the GPO’s for that user. User the computer with a user logon credentials for every time it is used. Make sure no other logon credentials work for the computer other then the assigned one’s.

It is the best way to assign GPO to a user instead of a computer if both are possible.

Hope it helps you.

Do update us again.

Thank you

Anil