| Author |
Message |
jimbo
Guest
|
 Posted:
Tue Nov 08, 2005 1:50 am Post subject:
Configuring administrative template for workstation |
|
|
I'm looking for some info on setting up administrative templates on a server
2003 box. I can change and push out policies from the domain server to
clients running winxp but the clients do not update when I change settings in
the administrative templates on the server. What am I doing wrong or do they
not work the same as policies? |
|
| Back to top |
|
 |
Paul Williams [MVP]
Guest
|
| Posted:
Tue Nov 08, 2005 9:51 am Post subject:
Re: Configuring administrative template for workstation |
|
|
What doesn't update?
You will probably find that this is by design. Windows XP uses a new
technology called fast boot optimisation. This basically skips a couple of
things when loading so you can get to the welcome/ winlogon screen quicker.
You can disable this using GPO.
If GPO isn't actually applying, you will be getting Scecli and Userenv
errors in the application event logs. A second reboot will usually trigger
policy application.
Also remember that some CSEs only apply during foreground processing (logon/
logoff or startup/ shutdown), and most others only apply when the version
number of the GPO has incremented.
--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net |
|
| Back to top |
|
|
jimbo
Guest
|
| Posted:
Tue Nov 08, 2005 5:51 pm Post subject:
Re: Configuring administrative template for workstation |
|
|
Paul,
Any changes made to the " computer configuration " administrative template
on the domain controller does not get updated to the winxp clients. Security
setting policies
" Account Policies " for example do update on the client side when changed
on the server. My question is does adminstrative templates not work the same
in configuring like the other policies or am I doing something wrong?
"Paul Williams [MVP]" wrote:
| Quote: | What doesn't update?
You will probably find that this is by design. Windows XP uses a new
technology called fast boot optimisation. This basically skips a couple of
things when loading so you can get to the welcome/ winlogon screen quicker.
You can disable this using GPO.
If GPO isn't actually applying, you will be getting Scecli and Userenv
errors in the application event logs. A second reboot will usually trigger
policy application.
Also remember that some CSEs only apply during foreground processing (logon/
logoff or startup/ shutdown), and most others only apply when the version
number of the GPO has incremented.
--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net
|
|
|
| Back to top |
|
|
Paul Williams [MVP]
Guest
|
| Posted:
Wed Nov 09, 2005 9:51 am Post subject:
Re: Configuring administrative template for workstation |
|
|
| Quote: | Any changes made to the " computer configuration " administrative template
on the domain controller does not get updated to the winxp clients.
|
Where is the GPO linked? If it is linked to the Domain Controllers OU, then
the machines are not within scope. If it is linked to the Domain, then we
need to troubleshoot it.
| Quote: | Security setting policies " Account Policies " for example do update on
the client side when changed on the server.
|
Account policies are different. They need to be applied at the domain
level. If they are applied anywhere other than the domain level the DCs
will not pick them up. The clients will always pick them up if they are
within scope, but the policies will only apply to local users stored in the
SAM of the client. For the policies to apply to domain users they have to
be applied at the domain level. This is because the PDCe processes this
information and writes it to the domain NC, where all other DCs pull these
settings from.
| Quote: | My question is does administrative templates not work the same in
configuring like the other policies or am I doing something wrong?
|
Different aspects of GPOs work differently. This is based on the Client
Side Extension (CSE) that process the GPO section. Admin templates process
once, and then don't process again until the GPO is updated. Admin
templates are the most commonly user policy items, you will find the some
other aspects of GPO don't apply like Admin Templates. Most do.
What is your specific problem?
What settings have you defined and where?
Have you any Userenv and/ or Scecli warnings and/ or errors in the
application event logs of the clients in question?
--
Paul Williams
Microsoft MVP - Windows Server - Directory Services
http://www.msresource.net | http://forums.msresource.net |
|
| Back to top |
|
|
|
|
|
|
FAQ
Memberlist
Register
Profile
Log in to check your private messages
Log in