Re: GPO not picking up computer settings

The resultant set is showing you what is, but you are attempting
to read your own meaning into what is.
That the Account Policies are computer policies means that they
are in effect on the computers in the OU, and those computers
only control their own accounts.
Reread my post. To have impact on domain accounts the policies
must be set in a GPO linked to the domain object, and they will
have an equal affect on all domain accounts.

"Jarryd" <j@xxx> wrote in message
news:%23nXHKHZWGHA.4960@xxxxxxxxxxxxxxxxxxxxxxx
OK, but why is it then when I run the report wizard for both Group Policy
Results and Group Policy Modeling does it tell me that the effective
settings are just the way I want them to be, but still they don't work. I
have tried adding the computer account to the OU to which the GPO is
linked but it still doesn't work. When I go inot the Local Policy editor
I see that it has inherrited the settings from the new GP I have created.
So it does seem to be doing some of the job, i.e. picking up the settings,
just not enforcing them. The GP is enforced on the OU and not enforced on
the domain, by the way. Is this the bit that you are refering to. Do I
need to enforce it on the domain? If so, then how do I enforce it only
for specific users?

TIA,

Jarryd
"Roger Abell [MVP]" <mvpNoSpam@xxxxxxx> wrote in message
news:uK1TOuYWGHA.3332@xxxxxxxxxxxxxxxxxxxxxxx
Account policies for domain users may only be set in a GPO linked
to the domain, and it applies the same way for all domain users.
Linked to an OU a GPO with account policy settings will only have
effect on the machine local account of computers in the OU.

"Jarryd" <j@xxx> wrote in message
news:e8T1EbYWGHA.5012@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

I have created a Group Policy for remote users. The only settings I
have configured are the ones that pertain to passwords and account
lockout. I have moved those users to an OU that is linked to the new
GP, but the settings weren't taking affect. So I generated a report and
it came back saying the policy was empty. But that's just wrong. If I
go in and configure user settings those are picked up, but the computer
settings aren't. Why?

TIA,

Jarryd







.

Relevant Pages

  • Local security settings in W2k adv server causes problems
    ... I am experiencing a pretty weird problem with some local policy settings on ... I used this to rename the administrator account on that server, ...
    (Focus-Microsoft)
  • Re: Kerberos User Ticket Lifetime
    ... Wong - as Joe has been saying, Account Policies receive special ... Account policy is a single instance thing on ... >>> different groups do inherit the correct GP settings, ... >>>>>with the Maximum User Ticket Lifetime parm? ...
    (microsoft.public.security)
  • Re: Local Account & Password Policy Options Greyed out for Admins?
    ... it seems to have set the security settings back to what they should be. ... Still, the settings for the password and account lockout policies are greyed out, so they still cannot be changed. ... Reboot the computer and you should be able to change password policy in Local Security Policy. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Cannot edit "Log on as a service" and "Allow log on locally" policies on W2K3 server.
    ... I am installing a new version of a program on my W2K3 SP1 server and one of the requirements is to create a "local" user account and grant this account ... However when I go into the Local Security Policy editor/Security settings/Local Policies/User Rights Assignment, I do not get the option to add or edit. ... These two policies both have different icons showing so I'm not sure what that indicates but am sure it has to do with why I cannot make any changes there. ... drill down to those settings and it'll tell you which policy is applying to those settings. ...
    (microsoft.public.windows.server.general)
  • Re: Password expires for no apparent reason
    ... Run net accounts on the client machine to see what the settings are set ... Were any settings within any policy set at the domain level have any ... As Harj said Account lockouts could potentially be a problem as perhaps ... Password expires for no apparent reason ...
    (microsoft.public.windows.server.active_directory)