Group Policy not applying after logoff \ logon

We've noticed during testing an issue around Local Group Policy applied via ZCM...
- user A logs in, policy applies correctly (folder redirection, taskbar settings etc)
- user A logs off
- user B logs in, policy applies correctly
- user B logs off
- user A logs in again, policy does not apply
The only way to get policy to apply again for user A is to either reboot or delete the local profile for the user manually
A few other details...
- Windows 7 SP1 Enterprise x86
- DLU Policy applied (non volatile user)
- user does not have admin rights (in the Users+ group)

gshaw0,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://forums.novell.com/

Similar Messages

Win7 Computer Config group policy not applying

Hi all: I am having a bit of trouble getting a Computer Configuration group policy to apply in Windows 7 using ZCM 11.2.3. I have two group policies, one for User Configuration settings and the other for Computer Configuration settings. User Config GP is associated with users and Computer Config GP is associated with Workstations. ZCM shows both policies as being successfully applied. Yet, if I run rsop.msc to generate a resultant GP set, all Computer Config settings show up as undefined.
I have used this same technique in XP for many years without issue. I suspect the User Config GP is overwriting all GP settings as it is the last to be applied, but since that policy is ONLY for User Config settings I do not see how. Can someone show me the "errors of my ways"?
Thanks a bunch, Chris.

I have an identical policy setup - a policy wherein "Computer configuration" is checked and configured (I don't even touch the User related settings) and is applied to workstations as well as a second policy with "User configuration" checked and configured (as with the computer policy, I don't touch the Computer related policy in this User policy) and applied to users. I set it up that way because I want general settings specific to our environment to exist and be effective for all users including IT staff in the Computer policy. I then want to restrict users within the User Policy. I have no Active Directory.
The computer settings apply intermittently with no rhyme or reason, which makes it difficult to troubleshoot. I have Internet Zone Assignments configured in the Computer policy, so specific users have problems when this policy is not effective which is how I became aware of the problem. I found that I can run "gpudate /force" as the user and the computer policy becomes effective, which is what I do most of the time since it's a quick fix and I can move on to other things. I've tried changing the order the policies are applied. I am considering creating a single policy with both computer and user settings and associating it with users in hopes that it will always apply, but thought I'd check out the forum before doing so. ZCM 11.2.3 and Windows 7.

Group Policy not Applying

Currently we are running ZfD 7 and Netware 6.5 and have recently upgraded all our workstations to Windows XP Service Pack 2. Our tree structure consists of an OU for each school level, elementary, middle, and high, and an OU for each school in that respective level. Example:
Elementary
West Main
South Main
Middle
Brown Middle
The current contents in each School OU have users, groups, policies, ect. Previously policy was applied by a workstation policy package that distributed all policies: user, machine, and security which were associated with the School OU. Now we split the policy into workstation packages and a user packages. The goal was to have the workstation apply the machine and security policy and the user policy to apply user settings and create dynamic the local user account.
The workstation policy remains persistent on the workstation while the user policy creates a local user (non-volatile) and applies the user policy from a server path depending on group membership. We have four different user policy packages: Student, Teacher, Specialist and Technology. Each with there own group policy user configuration. Everyone in our Tree has the appropriate permissions to access the policies. We configure the user policy package as follows:
Policies  Windows XP
Enabled Dynamic Local User
Enabled Windows Group Policy
Workstation Manager
Network Location
\\serverpath
Checked User Configuration
Policy Schedule
User Desktop is active
Advanced Schedule
Impersonation
Interactive User
Associations
Groups (Teachers, Students)
I can get the workstation policy to apply with no problem. The problem comes when a users logs on. It doesnt matter if a new user is being created or if they are simply just switching users. User group policy doesnt apply randomly. The strange thing is it does copy down to the machine. If I connect to the admin share on a newly imaged workstation (with no policy applied) and open c:\windows\system32\ you see the creation of GroupPolicy.Usercache Folder and it copies to the GroupPolicy Folder which is were it applies policy from. Also you can see policy dynamically changing if different users logs on. The Registry.pol updates in the c:\windows\system32\ GroupPolicy.Usercache\User folder and c:\windows\system32\ GroupPolicy \User Sometimes group policy applies and sometimes it does not. When a user logs on you see the policy that was copied down apply. For example the run option is taken away from the start menu. During the log on process this remains in effect but when the process completes its almost like policy is take away. When this occurs I can run WMSCHED.Exe and reapply the user policy and it will apply sometimes. I tried applying group policy through both groups and organizational units. Both with the same results. I was wondering if anyone has had issues with applying group policy with ZEN or if I am doing this incorrectly. Any help would be much appreciated. Thanks.

rscurr,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Group policies not applied after upgrading to Windows 10

After signing in on my T430 the group policies delivered by the AD-server are not applied. In particular the network drives don't get mapped (there are some other policies as well, but that's the bigggest problem). When i wait for some minutes in order to force a group policies update, the network drives are slowly getting mapped. The network connection works after signing in and the connection to the server is stable. I set up a clean Windows 10 installation on my T430 (instead of before just upgrading from Windows 8.1) and without installing any third party programs oder drivers and I experience exactly the same problem. On 6 other desktop-computers Windows 10 works fine, just our 2 upgraded Lenovos don't apply the group policies after signing in. I restored my Windows 8.1 image and now it works fine again, the group policies are applied after signing in. Has anyone else experienced this problem yet and found a solution for this?

I have contacted Lenovo via phone support. They told me Windows 10 isn't tested yet, they have not made any experiences so far and in order to that officially don't support Windows 10. Drivers may work, may not work. Contrary to this list - https://support.lenovo.com/us/en/documents/ht103535 We don't use any wmi filters. But what troubles me ist that at the first login of a user all group policies are applied, including mapped network drives. So everything is fine. But all further logins make it not work. I have contacted Microsoft at well, they tell me to contact Lenovo. Lenovo on the other hand tells me to contact Microsoft...

Windows 2008 R2 group policy not applied to windows 8 Workstations, but applied to XP and Win 7

I have a Windows 2008 R2 Domain Controllers and have a Policy to put a specify wallpaper, eventuality i have to change the Wallpaper, this setting applied sucesfully in Windows xp and Windows 7 workstations, but not applied in Windows 8 workstations even
if i run gpupdate /forcé,
Best Regards,
Thank you

Hi,
Thanks for posting in the forum.
Before going further, would you please let me know how did you configure the Group Policy setting to deploy the wallpaper? Have you configured some settings to limit the scope the GPO applying?
If all Windows 8 machines failed to receive the GPO settings? In order to narrow down the cause of the issue, I suggest we could try to collect the following information for troubleshooting.
GPMC.log
==================
a. On domain controller, click Start ->Run, type GPMC.MSC, it will load the GPMC console.
b. Right click on "Group Policy Result" and choose wizard to generate a report for the problematic computer and user account (please place appropriately). (Choose computer and select the proper
user in the wizard)
c. Right click
the resulting group policy result and click the "Save Report…" => save report to save the report to a HTML file.
Once we get the report, please check if the settings have been applied to the target correctly.
In addition, would you please let me know whether you have imported the latest Windows 8 Administrative Templates to the Windows Server 2008 DC? If not, please try to download and import it.
Then try to configure the wallpaper GPO settings again to see if it could help.
For details, please refer to the following articles.
Administrative Templates (.admx) for Windows 8 and Windows Server 2012
http://www.microsoft.com/en-us/download/details.aspx?id=36991
Set Desktop Background via Group Policy in Windows 7, Windows 8 in a Server 2008 or Server 2012 Domain
http://dizzyit.com/2013/04/14/set-desktop-background-group-policy-windows-7-windows-8-server-2008-server-2012-domain/
Hope this helps.
Best Regards,
Andy Qi
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.
Andy Qi
TechNet Community Support

Power Manager - no new profiles, group policy not applying

Hi there!
Having an issue with power manager (latest version, downloaded today) on Vista on a T61. The first problem is that I cannot create a power profile. If I hit New on the advanced page and fill all the stuff out, the named power plan does not show up. It's like I never did it.
The second issue is that group policy doesn't seem to apply, either. I tried to create a new power policy through AD using the GPO available for download. All the settings are filled out, it's named, and it doesn't show up.
For those concerned that the group policy is mucking up the ability to create a new one through the UI, that was the behavior before the group policy was set up.
rsop.msc shows definitively that the policy is applying to this machine.
Does anyone have any hints?
Thank you!

rscurr,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://support.novell.com and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Windows 2008 R2 group policy not applied on some of the computers

Dear All,
I have windows 2008 r2 as domain controller and configured group policy. when I am changing existing group policy most of the computers not affecting with update policy.
is there any server or any other method required to configure?
every time i need to update group policy manually on computers.
pls help
SUNIL PATEL SYSTEM ADMINISTRATOR

You have an issue with AD DS replication.Ensure all domain controllers are in sync

SQL2012 SP2 CU1 Availability Group database not synchronizing after applying February Microsoft patches

Hi,
We are starting our monthly patching and have a situation with SQL2012 SP2 CU1 Availability Groups databases not synchronizing after patching the secondary replica. This seems a little like
http://support2.microsoft.com/kb/3033492/en-us which was for CU3 and CU4 builds. The dashboard on the Primary shows the secondary as not synchronizing. The errorlogs on both nodes show the connection
has recovered but the dashboard shows critical errors. This is running on Windows 2012.
Thanks
Chris

Lydia,
I am referring to MS15-009 to MS15-017 that came out on Tuesday. These are the only patches we have applied. On our two node Availability Group setup we had the patches applied to the secondary node and then it was restarted. It came up fine and SQL is running
as expected.
This is from the primary node errorlog:-
AlwaysOn Availability Groups connection with secondary database terminated for primary database 'XXX_DEVL' on the availability replica with Replica ID: {e6468c4d-9431-4052-88c0-07d3b3eb428c}. This is an informational message only. No user action is required.
A connection for availability group 'YYYYY50_AG' from availability replica 'YYYYY50AV' with id [0E53235A-0FBB-4E18-8C40-A0D72F30C36A] to 'YYYYY50BV' with id [E6468C4D-9431-4052-88C0-07D3B3EB428C] has been successfully established. This is an
informational message only. No user action is required.
AlwaysOn Availability Groups connection with secondary database established for primary database 'XXX_DEVL' on the availability replica with Replica ID: {e6468c4d-9431-4052-88c0-07d3b3eb428c}. This is an informational message only. No user action is required.
On the secondary node errorlog:-
Skipping the default startup of database 'XXX_DEVL' because the database belongs to an availability group (Group ID: 65541). The database will be started by the availability group. This is an informational message only. No user action is required.
The state of the local availability replica in availability group 'YYYYY50_AG' has changed from 'RESOLVING_NORMAL' to 'SECONDARY_NORMAL'. The replica state changed because of either a startup, a failover, a communication issue, or a cluster error. For more
information, see the availability group dashboard, SQL Server error log, Windows Server Failover Cluster management console or Windows Server Failover Cluster log.
AlwaysOn Availability Groups data movement for database 'XXX_DEVL' has been suspended for the following reason: "system" (Source ID 5; Source string: 'SUSPEND_FROM_RESTART'). To resume data movement on the database, you will need to resume the
database manually. For information about how to resume an availability database, see SQL Server Books Online.
Nonqualified transactions are being rolled back in database XXX_DEVL for an AlwaysOn Availability Groups state change. Estimated rollback completion: 100%. This is an informational message only. No user action is required.
AlwaysOn Availability Groups connection with primary database terminated for secondary database 'XXX_DEVL' on the availability replica with Replica ID: {0e53235a-0fbb-4e18-8c40-a0d72f30c36a}. This is an informational message only. No user action is required.
Now I see the suspend message. Running the select on sys.dm_exec_requests there are NO DB_STARTUP ones on either node or blocking.
Next action is probably to have the patches removed from the secondary node and see if all is well and then try patch one by one to see which one causes the issue.
Chris

Error Message when logging on "The Group Policy Client service failed the logon. Access is denied"

Since the move to Windows 7 we have started getting this error above when people login at random times and on random machines, at first we thought it was only a select few users, but now it seems to have occurred to about 20 different Staff members working
at the school. Also of those 20 odd users it has happened to them on a few occasions.
What we know
We know this problem is only occurring to staff with Roaming Profiles, it seems like somehow the profile is not Synchronizing with the Servers File Share that houses the profiles, which causes the NTUSER.DAT file to become corrupt and go from being around
2 – 3 MBs to 256KB (In all cases where a user has had this issue there NTUSER.DAT file has been 256KB)
Current Resolution to the problem
When a staff member contact us with this problem, we fortunately have Previous Versions working on the profiles folder on the server, so we are able to restore their NTUSER.DAT file from 1 to 2 days before it became corrupt, which then seems to allow them
to log on fine
What we have tried so far & suggested so far
After some research on Google, we found the following thread on EduGeek
http://www.edugeek.net/forums/windows-7/78733-windows-7-user-profile-failed-error-again.html#post700415
Which suggested that the problem may lay within registry, so we implemented the Script that was posted on the website, however this has not seemed to make any difference
In the early stages when only 5 – 10 staff seemed to be having the problem, we believed the issue could be with just certain AD accounts. It had not seemed to happen to any recently created AD accounts so we thought it could be a corrupt attribute on
the user so we delete one of the staff AD accounts that had the problem and creating a brand new one, however within about 2 – 3 weeks that staff member had the issue occur again
Leading on from point two, we also thought the problem could be with people using multiple computers, logging on in 2 places and not logging off properly, but unfortunately the staff member referred to in point 2 only uses the one computer in reception.
Another potential cause that we figured might be the route of the problem, was it could be specific computers that are not communicating properly with the server, which could be causing this problem to occur, but we have no real way of testing this,
as the staff generally log onto 3 – 4 different computers throughout the day and in different location
We log a call with EE and they just pointed us to various websites that we had already checked and wasn’t much help.
In Summary
This error has now occurred with about 20 members of staff, we currently only use Windows 7 at our Senior School & Moving to Windows 7 at our Prep School in the Summer
holidays, we would like to find out the route of this problem ideally before then, as we could potentially be doubling the amount of staff with the problem after the move. Has anyone else seen this problem or have a brain wave on how to solve it?
Regards
Andy

Hi Dudleya,
First of all ,I would suggest to check the permissions of the NTUSER.DAT registry hive .Here is a link for reference :
The Group Policy Client service failed the logon. Access is denied(Juke Chou`s answer)
https://social.technet.microsoft.com/Forums/windows/en-US/8c0054a3-35be-4fc4-839c-e2176613eb23/the-group-policy-client-service-failed-the-logon-access-is-denied?forum=w7itpronetworking
Please refer to this link and add the registry keys to have a check .Please backup the registry keys before you made modifications to them.
The Group Policy Client Service Failed The Logon In Windows 8(It should also work on windows 7 )
http://www.thewindowsclub.com/fix-group-policy-client-service-failed-logon-windows-8
If the issue persists ,we can refer to this link to troubleshoot this issue .
Troubleshoot User Profiles with Events(It should also be applied to windows 7 )
https://technet.microsoft.com/en-us/library/jj649075.aspx
NOTE: This response contains a reference to a third party World Wide Web site. Microsoft is providing this information as a convenience to you. Microsoft does not control these sites and has not tested any software or information found on these sites.
Best regards

The Group Policy Client Service Failed The Logon

Hello,
When our students login to our Windows 7 machines they are getting this error:
The Group Policy Client Service Failed The Logon
Access is denied.
We are attempting to use both volatile and roaming profiles. The profiles are being stored on their H drives. I seem to only see the issue when the Windows NT 6.1 Workstation Profile.V2 folder already exists on their H drive. If the profile is not there then everything works fine.
Loading the user's ntuser.dat hive located in their H drive and changing the permissions manually to allow System, Administrators, and Users Full Control fixes the issue. How can I do this across all my user's H drives? Should I just delete them all and manually create the folder myself?
Last time I found one, the permissions for the hive had an "Unknown" user in the permissions list. There was no "Users" group. Removing the "Unknown" and adding "Users" fixed the problem. Are the permissions getting corrupted somehow?
Thanks for any assistance.
I've used the following link for reference:
Support | Windows 7 Roaming Profiles fail - user is assigned a temporary profile or fails to log on
Novell Doc: ZENworks 10 Configuration Management Policy Management Reference - Assigning a Roaming Profile Policy that has the User Profile Stored on a Home Directory

Originally Posted by coreyhansen
So it appears that I am experiencing the temporary profile detailed in my link I referenced above. I have status bubbles disabled by policy and didn't notice the notification. I'm going to try pre-populating my user H drives with the Windows NT 6.1 Workstation Profile.V2 folder containing an ntuser.dat file I've already edited the hive permissions of. This worked in small scale testing, so we will see.
I've been referencing this thread: http://forums.novell.com/novell-prod....html#poststop
So I have tried this with students that are experiencing the problem, and gotten limited success. It feels like it works at random, with around 50% of attempts working.
Has anyone out there had success with roaming profiles? Do I just need to go back to folder redirection? Will anyone please respond?
This is what the student's ntuser.dat hive permissions look like when things are not working:

ZCM 11 Group Policies not applying to satellite servers

Hi there
We are running 2 Windows 2012 Primary Servers and a SQL 2012 Database server at our main site, all remote sites have SLES11 SP2/OES11 SP1 as satellite servers. We upgraded all servers last weekend to 11.3.1 and now have an issue with Group Policies applying to the satellites. The satellites are all set up the same with Authentication, Collection, Content and Imaging roles.
Since we upgraded Group Policies are (99% of the time) not applying on satellite sites. I have tried manually replicating content (I assume policies will come from content replication?) to the satellites - I've done this with a zac cdp replicate and zac cvc and everything seems to replicate over however I tried highlighting a satellite server and clicking on Action, Specify Content - select the Policy that is not applying and move it into the selected Content to update column and when I click finish I get the error "The Wizard cannot continue for the following reason(s): Unable to complete your request for the following reason: Error updating content"
On a managed device at the satellite site if you look at the properties of the Zenworks agent and click on Policies it has applied 4 device assigned policies successfully - Remote Management, Power Management, Application Launcher Config and Application Control Policy, also has successfully applied 3 out of the 4 User Assigned Policies - Mandatory Profile, Dynamic Local User, Application Control - but not the Windows Group Policy.
Our PCs are on Windows 8.1 and all policies were applying fine before the weekend upgrade......
Has anyone else had any experience of Group Policies not applying that could point me where to look? I have logged an SR with Novell through our reseller but as yet I am getting no response back at all, not even asking me for more information.
Many thanks
Sharon

Sounds like you have a content replication issue more than a GPO issue.
Especially if the GPO works for locations that point to the Primaries
for Content.
Do you have throttling configured anywhere in any fashion?
You may need to increase the Replication Timeout to make sure content is
getting over to the Sats. Often increasing from 60 to 240 helps, but
watch out for throttling preventing content replication.
It is possible things are backing up.
On 7/31/2014 8:26 AM, shazzypoos wrote:
>
> I should add that when you looked at the "Click for Details" to the
> right of the Effective "Failed" status the message is "Policy
> Enforcement Failed : The action (0) threw an exception. Message (1).
> Exception (2) (grouppolicy, "None of the source locations could be
> found"
>
> Hmmmm! Currently in closest server rules there is only the server for
> the site it's on set - we do not want it to come back to the Primary for
> policies. As I say, this was working before the weekend upgrade. Thanks!
>
>
Craig Wilson - MCNE, MCSE, CCNA
Novell Technical Support Engineer
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.

Group Policy not populating IE11's compatibility sites.

We normally do not allow IE updates, but we got a pallet of new computers with IE11 preinstalled on them from Dell. I figured now is a good time to get this working in our environment.
The issue is that under our group policy settings are not putting the websites we need in compatibility mode. I have verified the group policy is applied to my computer using rsop.msc and I verified the settings in there. However when
I try to visit our loan application which runs at http://192.168.1.9 it shows a browser not supported message and says to use IE 5.5 or later. Well if one were to manually add the site in compatibility mode, then it would work. So we want to avoid
the calls to IT Support on how to add sites to compatibility mode and just control it from our end via Group Policy.
So under User Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > Compatibility View : we have these set:
Include updated Web site lists from Microsoft - Enabled
Use Policy List of Internet Explorer 7 sites - Enabled
Show:
http://192.168.1.9 (our lending application)
https://another website
http://192.168.1.15 (our lending application test site for new upcoming releases)

Hi,
The site list deployed using administrative template might not be visible in IE user interface. We could see the sites loading in the compatibility mode by opening the developer tool bar (press F12) and checking the browser mode.
Also, we can verify the setting in the client machine registry. The configuration is written to registry under HKCU(HKLM)\Software\[Wow6432Node]\Policies\Microsoft\Internet Explorer\BrowserEmulation\PolicyList. More information, please see
this blog:
How to add web site to Compatibility View List via GPO
In addition, we need to configure the "Turn on Internet Explorer Standards
mode for Local Intranet" policy and set it to disable.
For the “Use
Policy List of Internet Explorer 7 sites”
policy: We need to add Top level domain names in the
policy settings. Reference: Compatibility List FAQ
Some more information:
Missing the Compatibility View Button
Hope this helps
Best regards
Michael Shao
TechNet Community Support

11.2.3 security policy not applying

This was in another post felt it need its on post and subject.
11.2.3 has help, but now on device that have 11.2.3 the security policy is
not applying. I have 4 device I'm testing on one was a clean instill of
11.2.3 the other 3 were upgraded, out of all 4 only one the security policy
is applying right. Where would the security policy be store when it is
applied to a device. Is their a better way to apply security policy.
I found that the gpttmpl.inf file is not being copy to the
[C:\Windows\System32\GroupPolicy\Machine\Microsoft\ Windows NT\SecEdit]
folder and did confirm that it is in the zcm meachine cache folder
[C:\Program Files
(x86)\Novell\ZENworks\bin\handlers\CacheFiles\Work stationCache\GroupPolicy\M
achine\Microsoft\Windows NT\SecEdit]. I manual copy it to the SecEdit
folder
logged off back on and then did get the Security Options Settings set
properly.
So why is it not copying it over, the Registry.pol file is and all other
group policy are working (so far). And on the one computer that Security
Options is working right on and running 11.2.3 the gpttmpl.inf is not in
the
[C:\Windows\System32\GroupPolicy\Machine\Microsoft\ Windows NT\SecEdit]
folder ether and I have checked computers that are still on 11.2.0 and the
Security Settings are applied but the gpttmpl.inf file in not in the
[C:\Windows\System32\GroupPolicy\Machine\Microsoft\ Windows NT\SecEdit]. Is
ZEN suppose to copy gpttmpl.inf to the system32 group policy folder and if
so can this be fix? I really need Security Settings to apply.
Hope this makes sense.
And I have this problem on both 32 & 64 bit windows 7
I don't know if this affects Windows XP because I don't have any Security
Settings for XP set.
Thanks
Scott

Well I found this in the ZCM troubleshooting guide with the help of google
[When more than one Windows Group policy is applied to a device, the
security settings of the last applied policy are effective on the device.].
I have all ways had device first user last sense 10.3.3 - 11.2.0 and the
security policy did apply, at lease with WIN7. So on my test machines I
change it to user fist device last and now the security policy now works
with 11.2.3, but I still have to have a bundle to run gpupdate /force at
user login. If I done have the bundle to run the device group policy does
not apply sometime, I don't mine to have the bundle to run just why with
win7 is does not apply with out it and XP does with out it.
Also why does it not copy the gpttmpl.inf to
[C:\Windows\System32\GroupPolicy\Machine\Microsoft\ Windows NT\SecEdit]
directory?
>>> On Friday, March 15, 2013 at 12:34 PM, in message
<[email protected]>, Scott Malugin<[email protected]> wrote:
> This was in another post felt it need its on post and subject.
>
>
> 11.2.3 has help, but now on device that have 11.2.3 the security policy
> is
> not applying. I have 4 device I'm testing on one was a clean instill of
> 11.2.3 the other 3 were upgraded, out of all 4 only one the security
> policy
> is applying right. Where would the security policy be store when it is
> applied to a device. Is their a better way to apply security policy.
>
>
> I found that the gpttmpl.inf file is not being copy to the
> [C:\Windows\System32\GroupPolicy\Machine\Microsoft\ Windows NT\SecEdit]
> folder and did confirm that it is in the zcm meachine cache folder
> [C:\Program Files
> (x86)\Novell\ZENworks\bin\handlers\CacheFiles\Work stationCache\GroupPoli
> cy\M
>
> achine\Microsoft\Windows NT\SecEdit]. I manual copy it to the SecEdit
> folder
> logged off back on and then did get the Security Options Settings set
> properly.
>
> So why is it not copying it over, the Registry.pol file is and all other
> group policy are working (so far). And on the one computer that Security
> Options is working right on and running 11.2.3 the gpttmpl.inf is not in
> the
> [C:\Windows\System32\GroupPolicy\Machine\Microsoft\ Windows NT\SecEdit]
> folder ether and I have checked computers that are still on 11.2.0 and
> the
> Security Settings are applied but the gpttmpl.inf file in not in the
> [C:\Windows\System32\GroupPolicy\Machine\Microsoft\ Windows NT\SecEdit].
> Is
> ZEN suppose to copy gpttmpl.inf to the system32 group policy folder and
> if
> so can this be fix? I really need Security Settings to apply.
>
> Hope this makes sense.
>
> And I have this problem on both 32 & 64 bit windows 7
> I don't know if this affects Windows XP because I don't have any
> Security
> Settings for XP set.
>
>
> Thanks
> Scott

SU53 after logoff/logon

Hi, all,
When user gets "not authorized" message and runs SU53 he gets a report on failed authority check. However, if he logs off and logs on, the SU53 reports "The last authorization check was successful". Is it possible to keep the record of last failed check even after logoff/logon? I've heard that there's some setting somewhere for this.
Thanks!
Kind regards,
Igor

Hi
As far as I know you cannot keep the records of failed authorizations for all the users after login and logoff.
Because of the fact that when u logs off the user buffer is reset and all these settings are stored in User Buffer.
To do this, you can activate the trace for a particular user using ST01.
But this is not recommened to activate all the times as it would take lot of system resources.

The group policy client service failed the logon access is denied.

This one is starting to get on my nerves now. We've had 2 users suffering this problem on our Remote Desktop server.
We are running two Windows Server 2008 SP2 domain controllers, with two Windows 2008 R2 servers running RD Gateway and Remote Desktop Server.
The first user I had to recreate because of following instructions I googled because it caused the user to always logon with a temporary profile on the server and I could not resolve this.
This user I have managed to cleanly delete the local logon profile.
BOTH of these users are on roaming profiles, as are most of the users that are logging in to this server (for reasons that they move around the office). On the server, the user is listed twice one with a .v2 extension (XP machines at desks)
The user we are having a problem with at the moment was working perfectly fine a couple of weeks ago when they last logged into the server.
Could this be down to me setting an over ride on the settings that force people to logout completely after an hour of idle time, resulting in an unclean logoff?
Some of the messages that are in the event log for when that user attempts to login:
Event id: 1542
Windows cannot load classes registry file.
DETAIL - The system cannot find the file specified.
Event ID: 6001
The winlogon notification subscriber <Sens> failed a notification event.
Event ID: 6004
The winlogon notification subscriber <GPClient> failed a critical notification event.
I'm also getting a constant batch of
Event ID: 510
Folder redirection policy application has been delayed until the next logon because the group policy logon optimization is in effect
Any ideas why this should happen? I need a solution as soon as possible please as these users are running our sales department from home, and this user is due to be on the rota to do it this week! :)

Andy, I have been struggling with this issue on a new 2008R2 server. Can
you explain the commands you used to load ntuser.dat and usrclass.dat
into the registry? This is a truly maddening issue.
Thank you.
On 1/10/2011 11:01 AM, Andy Murphy wrote:
> Seems I have managed to over come this.
>
> After deleting the profile from within the Advanced System Settings >
> User Profiles on the RD server I still couldn't logon (as said above
> about clean deletion of the local profile)
>
> So I manually loaded the UsrClass.dat and NTUser.dat into the registry
> as they were not there. To do this I did the following:
>
> Loaded NTUser.dat from the profile on the server as a hive under
> HKEY_USERS to S-1-5-21-2055973500-2782184047-1828406536-1165
>
> Loaded UsrClass.dat from the profile.v2 on the server as a hive under
> HKEY_USERS to S-1-5-21-2055973500-2782184047-1828406536-1165_Classes
>
> Then logged in as the user, and it works perfectly again (it did hang on
> waiting for the session manager). To be sure I then copied the Default
> user to that newly created profile on the RD server and logged in again,
> no hangs. Perfect.
>
> Maybe this will solve a few other peoples problems with these related
> errors.
>

Group Policy not applying after logoff \ logon

Similar Messages

Maybe you are looking for