Quick Qs Regarding GPMC/Group Policy

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Hi there,

I've been troubleshooting some Group Policy related issues today, not having had much experience of Group Policy, I have a few questions.

Firstly, when you run a modelling report and have to enter the computername and select a user, does this work a bit like the effective permissions function within NTFS - eg interrogate the AD and work out which policies/settings SHOULD be applying, or does it scan the computer entered into the computername and see which policies ARE applying?

The reason I ask, is I believe that one of the computers I have been investigating has not been applying policies correctly.

Secondly, if a GPO other than the default domain policy is linked at domain level, does that mean it will propogate down through the different OUs in the domain (providing it isn't blocked)?

Finally, can anyone recommend any forums (other than this one) and suppport resources, good for referring to when dealing with GP issues and a forum where Group Policy related issues get discussed frequently? I'd really like to increase my knowledge in this area.

Cheers

Mad_Maxx

Mad_Maxx

 

Oh man! Ad-blocking software has been detected! :'(

This website is run by the community, for the community... and it needs advertisements in order to keep running. Blocking our ads means your killing our stats!
Please disable your ad-block, or become a premium member to hide all advertisements and this notice.

Hi

Yes. You can also use GPResult.exe and RSoP tools to pull down the same report. Former is command line tool while the other is wizard based. Difference between them 2 and GP modeling report is that modeling report is a simulation while other 2 actually evaluate real permissions. The only condition for RSoP and GPResult is that user had logged on given machine before (ie his credentials would be cached and profile created.

Yes. Unless any OU has block inheritance enabled or another policy with higher precedence has contradicting settings. I would also look for enforced and loopback policies as if not applied properly they can cause issues.
Also look at security filtering as maybe GPO is filtered from being applied to users in question.

Sorry no idea.