Only partial group policy replication

[simonp83]

Had a strange problem at work over the past couple of weeks that stumped me a bit, not a major issue that i managed to sort yesterday, but i was just wondering if anyone could identify what the exact root problem was?

Group Policy 4 - applies to students
Group Policy 3 - applies to staff
Group Policy 2 - applies to Network Managers
Group Policy 1 - applies to authenticated users (everyone who isn't a domain admin).

Group policy 1 contained the vast majority of settings, including the proxy settings for Internet Explorer (7 during roll out, 8 after updating it). GPO1 was applied first, at the bottom of the pile in the order screen, then GPO2, GPO3 and at the top of the list, last to be implemented, was GPO4. How the site was implemented was so that all of the group policies had the proxy settings in them, because the implementations guy copied another sites group policy that "worked" which was also copied from an older group policy that also "worked".

The problem at this site, and the older site as well, is that the proxy settings from group policy 1 wouldn't get applied to all other policies, so this was the explanation why the proxy settings were in all the group policies. Doing tests with student users and with the GP Reporting wizard in gpmc confirmed this, remove the proxy settings from gpo4, students couldn't access the internet at the new site. Remove proxy settings from gpo3 however, staff could access the internet at the new site, the old site staff lost internet when removing it from gpo3. Any ideas why all the other settings from gpo1 get applied absolutely fine, just not the proxy settings.

Things i did to troubleshoot, ensured the gpo4 is applied last, that nothing in gpo4 counters the proxy settings, that the security is setup correctly, applied to the right groups, and that all other parts of the policies are implemented as designed. To the resolve the issue, i created a new group policy from scratch, manually adding every setting from gpo4 over to the new gpo, applied it to the same users with the same security settings and it worked perfectly, so why didn't the original gpo4 work?

[Sparky]

This is good for testing\troubleshooting Group Policy.

http://support.microsoft.com/kb/323276

[simonp83]

Originally Posted by Sparky

This is good for testing\troubleshooting Group Policy.

http://support.microsoft.com/kb/323276

Went through all that, just couldn't figure out why gpo4 wouldn't take the proxy settings from gpo1. Just happy that gpo4 was so small so only took a little while to build a new one up from scratch.

[Sparky]

Did you try GP04 on its own?

Also did you check the event logs on the PC for GPO errors?

[simonp83]

Originally Posted by Sparky

Did you try GP04 on its own?

Also did you check the event logs on the PC for GPO errors?

Didn't check event logs as didn't see the point as i didn't see it as a workstation issue but a gpo issue as if you did a gpresult on the dc, it showed what the tests showed, that the proxy settings had to be in gpo4 to get applied. Tried just gpo1 and gpo4 together with no other gpos running on a brand new image with a brand new freshly created user account and still had problems. It also wouldn't explain why creating a new gpo with exactly the same settings made everything worked perfectly. I guess it was a corrupted gpo that was pulled over from the old site or something like that, from now on, writing them all from scratch .

[Sparky]

Originally Posted by simonp83

Didn't check event logs as didn't see the point as i didn't see it as a workstation issue but a gpo issue as if you did a gpresult on the dc, it showed what the tests showed, that the proxy settings had to be in gpo4 to get applied.

I thought the proxy settings were not being applied to workstations? The event logs may have showed some GPO errors or whatever.

Do you still have the GPO that is playing up? If you just apply it to one OU with a PC and user in that OU run gpreult after you log in. It would tell you if the GPO is being applied and if it is and the proxy settings are not there then it looks like a duff GPO.

[simonp83]

Originally Posted by Sparky

I thought the proxy settings were not being applied to workstations? The event logs may have showed some GPO errors or whatever.

Do you still have the GPO that is playing up? If you just apply it to one OU with a PC and user in that OU run gpreult after you log in. It would tell you if the GPO is being applied and if it is and the proxy settings are not there then it looks like a duff GPO.

oh did that, gpo settings all got applied but just completely ignored the proxy settings as if they weren't even there in the main gpo1.

[Sparky]

Originally Posted by simonp83

oh did that, gpo settings all got applied but just completely ignored the proxy settings as if they weren't even there in the main gpo1.

weird!

[Bluerinse]

Why didn't you use no override?

http://technet.microsoft.com/en-us/l.../cc978255.aspx

[simonp83]

What's the difference between no override and enforced? Tested with enforced but didn't resolve issue but the enforced command and no override command wouldn't have been a true solution anyway as settings in the other gpos were there to override gpo1, interms of enabling disabled options or disabling enabled options.