Group Policy upgrade to SP2 problem

Hi guys,
We are having the following issue. We have upgraded our XP group policy to SP2. Now each time users login, the first thing they see is a 'restrictions' window saying "this operation has been canceled due to restrictions in effect on this computer."
I wonder how I can figure out which group policy setting is causing this? The same policy worked when the policy was an SP1 policy, but once updated to SP2 it will give that error message. Thank you.

Jakub,
It appears that in the past few days you have not received a response to your posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at http://support.novell.com in both the "free product support" and "paid product support" drop down boxes.
- You could also try posting your message again. Make sure it is posted in the correct newsgroup. (http://support.novell.com/forums)
If this is a reply to a duplicate posting, please ignore and accept our apologies and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Similar Messages

Group Policy causes novell client to never show up windows XP

Hello,
I've been having a problem for the last couple of months that I have no
idea how to fix. I'm using Windows XP SP1, Novell Client 4.91, and
Zenworks 3.2 (included in Novell Client 4.90 SP2). This is a Netware 6
server. I am running E-trust Antivirus 7.1.192. I am having a problem
where the novell client will not show up after restarting the workstation.
An hourglass comes up for a couple of seconds, disappears, and then I'm
left with a blank screen and a mouse curser. The only thing I can do is
power the machine down manually, no keystrokes work at that point. It
doesn't happen all the time, it's completely random, but it occurs often
enough for the users to complain.
The source of the problem seems to be the group policy that is in effect
for students (this is a K-12 school district). If I disable the group
policy for students, the problem appears to go away (this is not an
option). If the login screen shows up, then everything else on the
computer functions perfectly (including policy after login). Are there are
group policy updates available that may solve this problem? Please let me
know if I've left out any important information. I appreciate any help
provided as I've been at this for the past couple months!
Thanks,
Patrick

Pat,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at
http://support.novell.com.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Using multiple LISTBOX in single Policy of Microsoft Group Policy .adm file?

OK, I am writing a .adm file and here is code for a policy within a category
CATEGORY !!A_CATEGORY
POLICY !!A_POLICY
KEYNAME "Software\Policies\ABC\ListBoxes"
PART !!PART_1_Text LISTBOX
ALUEPREFIX "FirstListBox"
END PART
PART !!DestPort_Label LISTBOX
VALUEPREFIX "SecondListBox"
END PART
END POLICY
END CATEGORY
The .adm file is successfully loaded in group policy editor without any problem and shows two list boxes too. I can give input for both list boxes and apply/ok without any problem. The real problem is that on registry location "Software\Policies\ABC\ListBoxes",
there comes only registry values as SecondListBox1, SecondListBox2, SecondListBox3 .... and no values for FirstListBox. Ideally, there should also be FirstListBox1, FirstListBox2, FirstListBox3 ...
I did some experiments and found that only the registry values with last PART (i.e. SecondListBox) are shown in registry and all other PART values before that are ignored. Lastly, the problem is only with multiple LISTBOX in a single policy. I can use multiple
CHECKBOX, COMBOBOX, DROPDOWNLIST, EDITTEXT, TEXT and NUMERIC within a single policy without any problem both in Windows 2003 Server and Windows 2008R2 Server
Baig

> and no values for FirstListBox. Ideally, there should also be
> FirstListBox1, FirstListBox2, FirstListBox3 ...
Since you do not use "ADDITIVE" it seems the whole key is cleaned out
before processing the second list. Give it a try :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Having problem with svchost.exe/ntdll.dll errors causing GPSVC (Group Policy Client) to crash preventing users from logging into the server.

Recently (within the past 2 weeks) I have noticed a few of our servers will have problems with the svchost.exe application causing the GPSVC (Group Policy Client) to crash. The only fix at that point is to reboot the server since the GPSVC service is tied
to svchost.exe and therefore is protected from being manually restarted.
I noticed the following errors when this occurs:
Log Name: Application
Source: Application Error
Date: 7/23/2013 4:35:26 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Server1.xxx.xxx.net
Description:
Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x46c
Faulting application start time: 0x01ce877f9476ac07
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: d252d26d-f372-11e2-8ad4-005056ac00e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-07-23T08:35:26.000000000Z" />
<EventRecordID>158950</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW19XM2.agency.nwie.net</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>46c</Data>
<Data>01ce877f9476ac07</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>d252d26d-f372-11e2-8ad4-005056ac00e8</Data>
</EventData>
</Event>
All of our servers are running Server 2008 R2 Enterprise where we use Citrix to deliver desktop sessions to our users, but some are virtual and some are physical. This seemingly impacts our virtual machines more, and our VMs are hosted through VMWare, however,
about 5 months ago a similar error fired on a non-virtual machine:
Log Name: Application
Source: Application Error
Date: 2/27/2013 6:57:58 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: AAW29033
Description:
Faulting application name: svchost.exe_gpsvc, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x6c0
Faulting application start time: 0x01ce14e1af313fd9
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: ed3d01c4-80d4-11e2-9128-b499baa9e5e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-27T11:57:58.000000000Z" />
<EventRecordID>286291</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW29033</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe_gpsvc</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>6c0</Data>
<Data>01ce14e1af313fd9</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>ed3d01c4-80d4-11e2-9128-b499baa9e5e8</Data>
</EventData>
</Event>
I've searched and cannot seem to find any information as to what may be causing this, or even really where to start. Would someone be able to help me identify what might be causing this event, specific with the Exception code: 0xc0000024, which causes
the Group Policy Client service to stop?

You still out there looking at things? If so I have an update. The issue hasn't stopped, even though it did seemingly die down for awhile, however, it is now back with a vengeance.
I am able to force it to happen by killing the svchost process that is hosting GPSVC. If I run gpupdate /force, then logout/login it does get GPSVC running again. Furthermore, if I simply start svchost again via the Task Manager GPSVC starts running again.
When I access the server remotely with KVM it acts just like it does as if I'm logging into it via Citrix/RDP which for Admin IDs gives an error saying "Failed to connect to a windows service. Windows could not connect to the Group Policy Client service...",
however, normal user accounts just get a message when logging into the server "The Group Policy Client Service Failed the Logon. Access is denied."
I haven't opened a case with Microsoft yet, but we about ready to because of the increase in these errors.
If you have any further suggestions that would be great, otherwise I'll provide an update once I get word back from Microsoft.
**EDIT -- apparently I mistook the the server's SCM's actions as my own. I was able to successfully crash the GPSVC service by killing the hosting svchost process, however, after I crashed it and let it sit crashed for awhile when I attempted
to restart either by starting a svchost task, or running gpupdate /force it failed. Either that, or there is a timing issue where if we don't restart the svchost process, or run gpupdate /force quickly enough it won't be able to recover without a reboot.

Launch problem opening PSE 13 from a read only desktop applied by group policy

PSE 13 won't launch. What is different between opening PSE 13 and other programs? On a normal login it opens. Are there special requirements?

Hi,
Thanks for posting your issue in the forum.
Based on your description, I suspect that maybe Software Restriction Policy has been configured in the domain. At this time, I suggest we could try to collect the following information to narrow
down the cause of the issue.
GPMC.log
==================
a. On domain controller, click Start ->Run, type GPMC.MSC, it will load the GPMC console.
b. Right click on "Group Policy Result" and choose wizard to generate a report for the problematic computer and user account (please place appropriately). (Choose computer and select the proper
user in the wizard)
c. Right click
the resulting group policy result and click the "Save Report…" => save report to save the report to a HTML file.
Once we get the report, please check if the Software Restriction Policy has been configured and applied to the problematic computers and users. If so, please disable the policy setting to see
if the issue persists.
In addition, please try to refer to the following articles for detailed information about Software Restriction Policy and how to troubleshoot Group Policy problems.
Software Restriction Policies
http://technet.microsoft.com/en-us/library/hh831534.aspx
Troubleshooting Group Policy Problems
http://technet.microsoft.com/en-us/library/cc787386(v=ws.10).aspx
Hope this helps.
Best Regards,
Andy Qi
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback
on our support quality, please send your feedback here.
Andy Qi
TechNet Community Support

Wireless Group Policy Problem - Half the policy applying

Hi
I'm at a loss for where to investigate this one so I'm hoping for some suggestions.
We have a single GPO to send out settings for wireless access to our network. On the wireless we have two SSIDs as below.
1. Staff SSID
My manager wanted to reduce the security issues with this as much as possible, so I've generated a GUID for the SSID name, set it not to broadcast the SSID and set the group policy to show the network as "<company
name> Staff". It uses WPA2-Enterprise with RADUIS authentication to silently pass the authentication credentials of the currently logged on user providing SSO.
2. Guests SSID
This uses a preshared WPA2 key and provides guests with internet access and is blocked from the local LAN.
The GPO is applied in such a way that company laptops are have the Staff SSID displayed in the available connection list, they're allowed to connect to it (as long as they're in the appropriate AD group for RADIUS authentication) but they are blocked from
connecting their laptops to the Guests SSID. The important thing is that this single GPO controls both settings.
On a few laptops we have been noticing that the blocking of the Guests SSID is working fine, but the Staff SSID is failing to show. Its as if only half the policy is applying. This is happening to only a small number of laptops which reside in the same AD
OUs and it doesn't matter who logs on, the same problem occurs. The laptop is able to view all other wireless networks in the vicinity.
I have logged in to one as myself (with Domain Admin permissions) and I get this problem, but on other laptops, the policy applies completely allowing me to connect to the Staff SSID while blocking the Guests SSID, as it should.
I've run a RSOP against the laptop which shows that the policy is applying (confirmed by the fact that the Guests SSID is blocked) and the only problem I can find in the event logs are for the EapHost service with event ID of 2002. I've followed the advice
in a few forum posts below but have been unsucccessful (not even sure if it's related to the GPO issue).
http://www.eventid.net/display-eventid-2002-source-Microsoft-Windows-EapHost-eventno-10874-phase-1.htm
http://www.sevenforums.com/network-sharing/336450-event-id-2002-source-eaphost-eap-method-dll-path-name-failed.html
Any suggestion would be greatly appreciated.

Hi Daverino,
Since RSOP shows that the policy has been applied, it should not be a grouppolicy issue.
According yourdescription, it seems that the system of the laptop has been changedby the user data.
Could you please post the original information about event 2002? It is useful for further troubleshooting.
Best Regards.
Steven Lee
TechNet Community Support

Fireworks 8 Installation Problem via Group Policy

Hi,
We are trying deploy Studio 8 across our site using the
provided MSI's and Group Policy following this guide -
http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=332882
I have created the mst files for all products and set them to
be deployed by group policy. Dreamweaver, Flash, Contribute, Flash
Video Encoder and Flash Extensions Manager all install fine however
Fireworks will not, looking in the event log it doesn't even
attempt to install. All folders have the same permissions, the MSI
& MSTs are all part of the same Group Policy Object using the
"Software Installation" method with the same permissions.
Fireworks will install using MSIEXEC from the command line so
the package and mst are fine.
Has anyone else come across this problem?
Thanks
Matt

We are having the same issue here at our NSW High School. I
have traced the problem to be that Fireworks wants to deploy in
Chinese (instead of English) and because of this it will not
install. I am looking for a way to convert the msi file to an mst
so I can choose English as the default install language.
Hope this info is useful

Active-X update group policy problem

I am having problems distributing
install_flash_player_active_x.msi via a group policy in our MS AD.
I am familiar with creating GPOs. I used a GPO to distribute
Adobe Reader without any problems, but this active-X update will
not apply via a gpo. The error I get is: The install of application
Adobe Flash Player 9 ActiveX (2) from policy Adobe_Flash_Patch
failed. The error was : The installation source for this product is
not available. Verify that the source exists and that you can
access it.
I created an administration install and used the same shared
distribution folder as I did for Adobe Reader so I know that this
error is not due to permissions. Any help would be gratefully
appreciated.

> 9. The Database Security Editor appears. You need to add the user or
> group that you want the *Security* tab to be removed from.
What EXACT group was entered in your GPO there?
And if you want to revert, it is most probably NOT sufficient to simply
unlink the GPO, but you need to implement a second GPO that grants the
required read rights (aka "removes the deny entry")
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Windows 8.1 mandatory profile Group Policy printer problems

We're a school district that is using mandatory profiles for the students. We use both Win 7 and Win 8.1 on the workstations. We're having a problem with group policy printer deployment on just the Windows 8 Workstations. I've tried using both the deployment
method in policies and the Preferences with Item level targeting and on the windows 8 ones its always intermittent. Sometimes you login and get the printers or some of them and sometimes not. Other times if you log out and back on etc. I've been troubleshooting
this for a week and have found with Win 7 it seems to always work but on our Win 8.1 ones about 50/50. The error in the Event log for that printer is this.
Group Policy Object did not apply because it failed with error code '0x80070057 The parameter is incorrect.' This error was suppressed.
What I've found that if I create a test account that does not use the mandatory profile the printers always map. Even on Windows 8.1. So far thats the only commonality. Can anyone tel me what I can look at with this. If they never worked that would be an
easier problem but its not consistent.
Thanks
Jason

Hi Jason, Did you ever find a fix for this as we are having exactly the same problem only with windows 8.1 computers using mandatory profiles and it's driving me mad. Any help would be much appreciated Thanks Dan

ZENworks 6.5 SP1b And Group Policy Editor Problems

I just installed ZENworks 6.5 SP1b on a brand new test server that I am
running. I have no users or strain on the server. After I installed the
service pack it started take about 20 to open the Group Policy Editor for
a user policy and about a minute 20 to close it. I was using it before the
upgrade and it only took like 10 seconds to close before. What's up? Can
any one help?

Yeah Sorry I clicked the wrong one
> I presume someone will help in the Desktops forum, since this is for
> server management...
>
> --
>
> Shaun Pond
>
>

Flash 10 msi problems through Group Policy

Here's the problem:
We've signed up to Adobe to get there official corporate Flash and Shockwave msi's for network distribution. They have been set in Group Policy and sent down to our machines. It says its installing and when you check add\remove programs both are installed. Some flash\shockwave sites are fine others say that flash 10 is not installed 'do we want to update' or we get this message "can't verify publisher.. swflash.cab". If logged on as an administrator we can run the update and all is fine, this however defeats the purpose of the GP distribution.
When the msi's are run manually on a machine they work perfectly, so the problem exists while being sent through Group Policy. The clients\PC's are running XP and are fresh builds (there are no older versions of Flash on them).
I've looked online for similar cases, but nothing. Has anyone else encountered this issue? or have any ideas why the install will not fully go down?

Don't worry, I've sorted it.
An ex employee had created a package with flash 8 installing alongside\inside another one (totally unrelated to what should have been going down). Which meant the flash 10 was getting overwritten. It's been removed, and everything works fine.
Bye.

Upgrading OES 11SP1 to OES11 SP2 problems

Trying to upgrade a OES11-SP1 Server OES11-SP2
but run into problems at Final stage of eDirectory Upgrade
Server is looking for OLD Master replica - which no longer exists
History
Some month ago due to server crashes I added a Server (this time as a Virtual Server)
Copied Data includin GW system
Ran NDSREPAIR to make this the Master Replica (old server now disregarded)
deleted OLD CA and recreated CA on the new server
reconfigured GW etc
(single Server - no external replicas - this server)
Everything running fine for some months
Now needed to upgrade to OES11 SP2 and at final stage ie. when upgrading edirectory its looking for OLD IP
only option is ABORT - so my upgraded did not finish
I'm doing this as a Physical Media upgrade as per OES Manual
I went back to my BACKUP of the VM
I made sure /etc/sysconfig/edir_oes11_sp1 file had the correct IP
I went into YaST > OES Configuration and made sure there is NO mention of OLD IP in any of them LDAP, eDirectory, CIFS etc
are there any other config files I need to check??
Any pointers much appreciated.

On 9/29/2014 2:06 AM, bharat1 wrote:
>
> The old server kept crashing.
> I added a new server to the Tree and started copying data off after
> shutting down Groupwise on the master.
>
> Server crashed after copying GW (all files) and part way through copying
> other files
> at that point tried various things but had to abandon the old box and
> make this one master.
> I manged to sort GW & had to take out HDD from the old server to access
> other data
> and setup CA etc
> That was some months ago
>
> I'm using physical Media method to upgrade from SP1 to SP2
> I'm following the docs Upgrading to SP2
> I get past the NCC config > Upgrading the Server Software during upgrade
> and then get to Upgrading eDirectory
> Unfortunately the only option is Upgrade or Abandon at this stage!!
>
> Is there no other way to interrogate eDirectory settings
> I'm sure I'm not the first to have a crashed server !
> and won't be the last
>
> I thought of adding a permanent 2nd IP like you suggest but not tried it
> yet !!
> guess I'll have to try that next... (since its a VM I can have multiple
> attempts)
>
>
not sure if this is too late to help - we ran into something similar a
while back. The wrong ip address it was looking for was in a file
/etc/sysconfig/novell/edir2_oes11
after changing the ip address in that file we were able to complete the
ugprade

"Group Policy Service & Permission Problems" I Will Never Buy Microsoft Windows Computers Again..

I am trying to get some last bit of use out of my Worthless Microsoft Windows Software.. I have spent more time attempting to make this worthless junk work, than I ever get using the computer for what it is designed for.. Both My Windows 7 Pro,
and my Windows 8.1 are the worst products Microsoft has come out with ever.. I started out using Punch Card Machines, in the 70's that worked better than the junk Microsoft is selling us today.. The last 13 computers I have purchased with Windows software
are all in the dumpster. Their tech support is worthless, and half the time you get sent from one phone number to another, and no one knows anything.. I have purchased two sets of software from Microsoft store that have turned out to be Non-Genuine, I paid
full price for, have receipts of sales, dates, validation key numbers, and still spend three days in a row trying to explain to the other end that my software they sold me is shit, and no one understands.. And on top of that will not give me a e-mail address
to send them a copy of the proof of purchase to them for my file, and to prove to them they are selling shit, and they will not give me a address to send them their problems plagued software.. I have three sets of software that i downloaded,
and had disk sent as backups that have bad validation keys, and Microsoft will not honer their sales, and will not give me keys that work..
If it dose finally work, I can not get the "Diagnostic Policy Service" to start, this online troubleshooting will not work, never has worked on windows 8, nor have I ever had any sound on the same computer, nor has my Windows Media
Player ever worked either.. Both Win 7 Pro, and Win 8.1 Group Policy will not let me download anything on the C-drive that can possibly repair what is wrong with the Crap at hand, Their my computers, but I have no permission to do a goddamn thing to repair
what is wrong with it,,I do not want to read another fucking article on tech shit, I want to know how to delete "Group Policy" from every machine I have, because its only purpose I see it to keep me from using my machine , and forcing me to have
to sit on hold and listen to those idiots on the other end just say its another 99 bucks to fix something that I have already given them 99 bucks several times before to fix nothing.. WTF, I was never a fan of Bill Gates, but today he looks like a genius compared
to who/what is working there today.. Dose this happen to everyone, or am I just jinxed? Can someone give me a patch or something besides another article to make this shit work.. Thanks, Barnstormer2790

Wouldn't think anyone wants to help you at all with that attitude - Microsoft products work just great for me.
perhaps you should look closer to home for the issues you have!! Im Out!!!!

MSI Group Policy install failing because of administrator rights problem

I have succesfully installed the desktop manager software 4.6 on my PC using the MSI from the CD. I am a domain administrator, when I try to install the same MSI on other users in the domain through group policy who are not administrators the software will not install. I have checked and the policy is definately being applied and it says on logon that the Blackberry Desktop Manager software is being installed but no icon or program group is created.
I don't want to give users administrator rights as the users are not allowed to install software on their PC. Normally software installs through group policy without a problem. I don't want to have to go around to each PC and install manually if I can avoid it.
Any help would be most appreciated.
Solved!
Go to Solution.

Someone else would really need to answer this, but i have my own simple solution we use here.
Create a share file eg //138.218.137.22 etc etc for the user to go to. In here save a copy of the desktop manager. Get them to click and drag it to their desktop and install the file from there. (do not install the file directly from the shared drive)
Is the cd version won't work, get the install.exe from the blackberry site..
If your issue is resolved, put a checkmark in the green box that contains the resolution.
OR
If it was just/or also really helpful - Give it a Kudos.. Go on Mate.. Help the rest of the clueless blackberry user world find their answer too..
~Gday from Down Under~

New Group Policy not working on 2008 RDS in 2012 Domain - Security Filtering problem?

We have a Windows 2008 R2 RDS in a Windows 2012R2 Domain. We want to lockdown the 2008 RDS for Domain users that we have added to a new security Group--named "Data Collection Users". These users are "Domain Users" and login to the
2008 RDS using Windows XP SP3 machines to run a specific application -they do not use their local desktops for anything. WE added this group to the local RDU group on the RDS. We do not have any other users that login to the RDS through terminal,
including any Domain Admins.
So far we have done these steps:
On the DC, created new OU (called Terminal Servers) and moved the RDS into it.
Opened Group Policy on the DC, and under GP Objects, created a new policy called "TS Users Lockdown".
Linked the Policy to the OU.
Under Security Filtering we removed the Authenticated Users, added the RDS computer account (called QS2), added the "Data Collection Users" and chose Allow for "Read" and "Apply Policy"
Under Security Filtering, for Domain Admins, we chose Deny for "Apply Group Policy"
We edited the Policy (under Computer Configuration>AT>SYS>GP) to Enable Loopback processing - Replace mode.
We first tested the policy by trying to remove the "Run" from startup menu and "prohibit access to Control Panel".
We ran the Group Policy force update from within GP Management - ran successfully.
We did not reboot the RDS.
Neither of the settings we tried in Step 7 worked. Why Not?
Here are images from the Security Filtering:

Ok--Do I reboot the RDS or the DC? or both?
Does it look like my Security Filtering is correct? I have seen posts where you should not remove the "Authenticated users"?

Group Policy upgrade to SP2 problem

Similar Messages

Maybe you are looking for