Basic (hopefully) AD Group Policy question

Forums › IT Pro and developers › Basic (hopefully) AD Group Policy question

SteveFari

108 posts

Master Geek

#26116 12-Sep-2008 11:30

Hi there,

I am trying to set a GPO that adds files or folders to a users offline files folder in XP.

What I have done so far, without success:

Created a security group called TEST
Added a test user to the group
Created a new OU called TEST
Created and linked a new GPO policy to the TEST OU (users, admin templates, networks, offline folders, administrative controlled files)
Removed Authenticated Users and added the TEST group in security filtering.
Ensured that READ and Apply Group Policy were enabled in the settings for the TEST group
Performed gpupdate
Rebooted the XP machine

Result = nothing. The files do not appear in the offline files folder.

IF,
I move a user into the TEST OU it works fine.

I have read on google that doing what I have done should work when applying to a group.

Can anyone help me here?

Thanks,
Steve.

slister

17 posts

Geek

#163975 12-Sep-2008 12:29

Hi Steve
That is working as it should. The user has to be in an OU with the policy linked to apply the policy. The security group filtering lets you apply the policy to an existing OU but only to the users in the security group.

Clear as mud

Steve

Loopykiwi

16 posts

Geek

#163976 12-Sep-2008 12:32

Hey,

Everything you have done is correct except for the policy linking, if you are using a security group to restricted the policy just link it to the higher level container (Users). by linking to the Test OU you have restricted it to just that container, so it doesn't matter even if they have the security group it just won't apply unless they are in Test.\

Let us know how you get on

Loopy

SteveFari

108 posts

Master Geek

#164111 12-Sep-2008 22:12

Hi,

Firstly thanks for the replies, but I might need to be more specific.
I only want the gpo to apply to a few users, not all users, which is why I have created a new OU currently called test to hopefully only apply it to the users of a particular group within that OU.
Many pages found on google say it is possible and I've followed their instructions but still no joy.

Steve.

MrAlan

98 posts

Master Geek

#164855 16-Sep-2008 16:10

SteveFari: Hi,

Firstly thanks for the replies, but I might need to be more specific.
I only want the gpo to apply to a few users, not all users, which is why I have created a new OU currently called test to hopefully only apply it to the users of a particular group within that OU.
Many pages found on google say it is possible and I've followed their instructions but still no joy.

Steve.

For a GPO to be applied the users must exist within the OU that the GPO is linked to. So either move the specific users into your 'test' OU or alternatively link the test GPO to a higher level OU which envelopes all the domains users. The security setting you set on the GPO will then ensure that the settings in the 'test' GPO will only apply to the users in the 'TEST' security group and not everyone on the domain.