|
server
newsgroups
|
|||||||||||||||||||||||
|
|||||||||||||||||||||||
GPO - clarification questionHi,
I have a general question. I am using the GPM tool; On a certain OU (lets call it Dept) if I have 8 GPO's that show up under the Group Policy Inheritance tab, yet they do NOT show up under the Linked Group Policy Objects Tab, does this mean the policies are NOT being applied? Basically I see 8 GPO's under the GPI tab, but I see no GPO's listed udner the Linked GPO tab...kinda confusing... thanks, Mel If you click on the OU and the GPOs aren't listed, this means that the GPOs
aren't linked to that OU. So yes, you are correct, they are not being applied. In order to apply, a GPO needs to be linked to a container and enabled, and a user and/ or computer has to be within that container and have the permissions apply GPO. -- Paul Williams Microsoft MVP - Windows Server - Directory Services http://www.msresource.net | http://forums.msresource.net Thank you Paul.
Mel Show quoteHide quote "Paul Williams [MVP]" wrote: > If you click on the OU and the GPOs aren't listed, this means that the GPOs > aren't linked to that OU. So yes, you are correct, they are not being > applied. In order to apply, a GPO needs to be linked to a container and > enabled, and a user and/ or computer has to be within that container and > have the permissions apply GPO. > > -- > Paul Williams > Microsoft MVP - Windows Server - Directory Services > http://www.msresource.net | http://forums.msresource.net > > > > Unless I am misunderstanding your answer Paul I believe this is incorrect.
A sub ou can inherit a gpo from its parent ou and the settings from this parent gpo are to the applied (Inherited) to the child ou. Such as is the case of the Default Domain Policy. OU's many layers deep still have this gpo applied through inheritance. It must be enabled though. -- Show quoteHide quotePaul Bergson MVP - Directory Services MCT, MCSE, MCSA, Security+, BS CSci 2003, 2000 (Early Achiever), NT http://www.pbbergs.com Please no e-mails, any questions should be posted in the NewsGroup This posting is provided "AS IS" with no warranties, and confers no rights. "Paul Williams [MVP]" <ptw2***@hotmail.com> wrote in message news:eTS$4U1BHHA.4948@TK2MSFTNGP02.phx.gbl... > If you click on the OU and the GPOs aren't listed, this means that the > GPOs aren't linked to that OU. So yes, you are correct, they are not > being applied. In order to apply, a GPO needs to be linked to a container > and enabled, and a user and/ or computer has to be within that container > and have the permissions apply GPO. > > -- > Paul Williams > Microsoft MVP - Windows Server - Directory Services > http://www.msresource.net | http://forums.msresource.net > > > "Paul Bergson [MVP-DS]" <pbergson@allete_nospam.com> wrote in message ["can" should be "WILL (by default)" inherit.]news:ORrqpW$BHHA.3396@TK2MSFTNGP02.phx.gbl... > Unless I am misunderstanding your answer Paul I believe this is incorrect. > > A sub ou can inherit a gpo from its parent ou and the settings from this > parent gpo are to the applied (Inherited) to the child ou. Such as is the That is correct. All computers/users in the entire domain> case of the Default Domain Policy. OU's many layers deep still have this > gpo applied through inheritance. are affected (have the GPO applied) when it is linked to the domain. > It must be enabled though. Yes, but that is the default -- you do nothing special at thechild (OU) levels. Show quoteHide quote > > -- > Paul Bergson > MVP - Directory Services > MCT, MCSE, MCSA, Security+, BS CSci > 2003, 2000 (Early Achiever), NT > > http://www.pbbergs.com > > Please no e-mails, any questions should be posted in the NewsGroup > This posting is provided "AS IS" with no warranties, and confers no > rights. > > "Paul Williams [MVP]" <ptw2***@hotmail.com> wrote in message > news:eTS$4U1BHHA.4948@TK2MSFTNGP02.phx.gbl... >> If you click on the OU and the GPOs aren't listed, this means that the >> GPOs aren't linked to that OU. So yes, you are correct, they are not >> being applied. In order to apply, a GPO needs to be linked to a >> container and enabled, and a user and/ or computer has to be within that >> container and have the permissions apply GPO. >> >> -- >> Paul Williams >> Microsoft MVP - Windows Server - Directory Services >> http://www.msresource.net | http://forums.msresource.net >> >> >> > > Not so much incorrect; more lacking a large amount of detail! : )
Yes you are, of course, correct. Re-reading my answer I should have mentioned inheritance. I was referring to GPOs not being linked. I was being silly really, as I think (I can't remember what was going through my head and am making this assumption based on my post) I was referring to a weird issue that I helped the service management people with in work, where in GPMC no GPO was showed but under the GPO tab of DSA.MSC (on a diff. box) they were. The end result was that they weren't linked. I can't remember why they showed up in the original GUI... Thanks for the correction. -- Paul Williams Microsoft MVP - Windows Server - Directory Services http://www.msresource.net | http://forums.msresource.net Yeah, well I'm guessing it will be the only time. You just don't make
mistakes. -- Show quoteHide quotePaul Bergson MVP - Directory Services MCT, MCSE, MCSA, Security+, BS CSci 2003, 2000 (Early Achiever), NT http://www.pbbergs.com Please no e-mails, any questions should be posted in the NewsGroup This posting is provided "AS IS" with no warranties, and confers no rights. "Paul Williams [MVP]" <ptw2***@hotmail.com> wrote in message news:uxbkK1BCHHA.4672@TK2MSFTNGP02.phx.gbl... > Not so much incorrect; more lacking a large amount of detail! : ) > > Yes you are, of course, correct. Re-reading my answer I should have > mentioned inheritance. I was referring to GPOs not being linked. I was > being silly really, as I think (I can't remember what was going through my > head and am making this assumption based on my post) I was referring to a > weird issue that I helped the service management people with in work, > where in GPMC no GPO was showed but under the GPO tab of DSA.MSC (on a > diff. box) they were. The end result was that they weren't linked. I > can't remember why they showed up in the original GUI... > > Thanks for the correction. > > -- > Paul Williams > Microsoft MVP - Windows Server - Directory Services > http://www.msresource.net | http://forums.msresource.net > > 
Other interesting topics
Domain Users Can't Print to Networked Printer
Primary time server CSVDE Import Problem how to disable USB sticks through AD a new company External Trust Problem Event log entries regarding KCC error RIS file copy fails after 3rd pc starts build cannot login locally to 2k servers after live comm server install Removing root domain but not child |
|||||||||||||||||||||||
