I got rid of the Vista Policy Definitions in the Domain Controller
central Store and then I copied the Windows 7 Policy Definitions from
C:\Windows\PolicyDefinitions to the Domain Controller central store.
I logged into the Client as the Domain Administrator and made some
changes to the Org. Unit and GPO so that the changes I wanted would be
made with the new Policy Definitions. After this I ran a 'gpupdate
/force' on the server. I then logged into the client as the testuser to
see if my policy changes got propagated.
I ran the rsop.msc on the client, but got this error message:
"The RSop snap-in was unable to generate the
computer's data due to insufficient permissions. The
snap-in will continue to start but only the user's data
will be displayed."
I looked at the Action/properties on rsop and saw this:
Mode: Logging
User name: CADLAB\testuser
Display user policy settings: Yes
Computer Name: CADLAB\CADLAB4-PC (Access Denied)
Display computer policy settings: Yes
The computers are part of the Domain, but I'm wondering if this is
because the computer itself is not in the Organizational unit. I didn't
put the computers in the OU because I didn't want to restrict based on
the computer, but do I have to put the computer into the organizational
unit in order to get the GPO to apply for a user that logs into that
computer?
I only wanted to attach the user to the Organizational Unit so that
other users could login to that same computer and not be as restricted.
This is what I want to do:
I want to have a GPO apply to a set of users (one user is called caduser
and the other user is called testuser). These users are restricted
pretty severely. For example, they can't bring up the task manager, they
can't install programs, the documents directory is cleared when caduser
logs out, etc.
I still want other groups to be able to login on these same computers
and use the same computers. Those users would have less restrictions:
They would be able to keep their Documents, etc.
Is this configuration possible or do the Computers have to be contained
within an Organizational Unit?
I thought I'd create an Organizational Unit and use a GPO to restrict
users in the OU.
CADUSERS_OU -> CADUSERS_GPO
I noticed that "Authenticated Users" are part of the CADUSERS_GPO, but
I'm wondering if I this will cause all Authenticated Users to be as
restricted as these cadusers and if so, do I need to remove
Authenticated Users from the caduser's GPO?
Thanks!
-Alan Edwards
On 3/20/10 10:04 AM, Meinolf Weber [MVP-DS] wrote:
> Hello Caduser (remove big X),
>
> On Windows 7 you find all of them into:
> C:\Windows\PolicyDefinitions
>
> When you run rsop.msc on the client can you see that the GPO is applied
> you has configured?
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Thanks Meinolf,
>>
>> I copied the Policy Definitions (described in the URL:
>> http://support.microsoft.com/kb/929841) into the central store on the
>> Windows 2003 R2 Server's Domain Controller. I downloaded and then
>> logged in as the Domain Administrator on the Windows 7 client and
>> installed the RSAT for Windows 7 on the Windows 7 client. I enabled
>> the administration tools on the Windows 7 client and was able to bring
>> up the Group and User Management Console. The Management console
>> showed that I was pointing at the Domain and had all the Domain
>> Controller information contained in the forest domain. I was also able
>> to bring up the Group Policy Editor. The problem I'm having is that my
>> changes don't seem to make it back to the client.
>>
>> I have a test user login and I created an Organizational Unit and
>> attached a Group Policy to the Organizational Unit. I put the test
>> user in the Organizational Unit and made some changes to the Group
>> Policy to remove Control-Alt-Delete options. I also added a Group
>> Preference that set an environment variable.
>>
>> When I logged in as the test user, none of the settings were enforced.
>> Ctrl-Alt-Del had every option available (I had disabled several
>> options) and the environment variable didn't get set.
>>
>> I even tried doing a gpupdate /force to force an update, but that
>> didn't work.
>>
>> Maybe I copied the wrong Policy Definitions (I got them from the link
>> in http://support.microsoft.com/kb/929841). Now that I look at that,
>> it looks like those are for Windows Server 2008. Maybe that's the
>> problem and all I need to do is find them for Windows 7.
>>
>> I think I'm missing something, but I haven't figured out what yet.
>>
>> -Alan Edwards (not the MVP Alan Edwards)
>> cadlab at my address on alanedwards dot net
>> Meinolf Weber [MVP-DS] wrote:
>>
>>> Hello Cadlab (remove big X),
>>>
>>> Configure the GPO settings you need from the Windows 7 machine with
>>> GPMC installed las you know it from the earlier OS. They will be
>>> stored in the central store and replciated to all DCs like the normal
>>> GPOs.
>>>
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers no rights.
>>> ** Please do NOT email, only reply to Newsgroups
>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>> I think I need to get more information about how to do this.
>>>>
>>>> By putting the templates in the central store of the Domain
>>>> Contoller on the Windows 2003 Server, does that mean that when I run
>>>> mmc on the Windows 7 client (while logged in as the Domain
>>>> Administrator) and add the Computer Management snap-in does this
>>>> allow me to make changes directly to the Domain Controller, or does
>>>> it only allow me to define a group policy object that I need to
>>>> either apply to individual Widnows 7 Client machines or that I can
>>>> load into the Domain Controller running on the Server?
>>>>
>>>> I guess what I'm wondering is how to get these new Policy
>>>> definitions applied to User's that are in the Domain where I have an
>>>> OU already setup.
>>>>
>>>> On 3/13/2010 4:49 AM, Meinolf Weber [MVP-DS] wrote:
>>>>
>>>>> Hello Cadlab (remove big X),
>>>>>
>>>>> You have the option to create a central store for managing and
>>>>> replicationg GPOs for Windows Vista and higher OS:
>>>>> http://support.microsoft.com/kb/929841
>>>>>
>>>>> For managing the GPO setting use the Windows 7 machine.
>>>>>
>>>>> See also:
>>>>>
>>>>> http://blogs.technet.com/grouppolicy...17/questions-o
>>>>> n- admx-in-windows-xp-and-windows-2003-environments.aspx
>>>>>
>>>>> Best regards
>>>>>
>>>>> Meinolf Weber
>>>>> Disclaimer: This posting is provided "AS IS" with no warranties,
>>>>> and
>>>>> confers no rights.
>>>>> ** Please do NOT email, only reply to Newsgroups
>>>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>>>> I have a Windows 2003 R2 64-bit Server with 8 Windows 7 clients
>>>>>> and I've been having problems setting up a Group Policy for these
>>>>>> Windows 7 clients. I can't seem to turn things off (like not
>>>>>> allowing them to bring up the task manager, etc). I've been
>>>>>> looking for articles that talk about managing Windows 7 clients
>>>>>> from a Windows 2003 Server, but everything that I've been finding
>>>>>> talks about the Windows 2008 Server.
>>>>>>
>>>>>> Now I'm beginning to wonder if it's possible to manage Windows 7
>>>>>> clients from Windows Server 2003.
>>>>>>
>>>>>> Can anyone tell me if this is possible and maybe to point me in
>>>>>> the right direction toward looking for information on how to do
>>>>>> it?
>>>>>>
>>>>>> Thanks!
>>>>>>
>>>>>> -Alan Edwards (not the MVP Alan Edwards)
>>>>>> cadlab at my address on alanedwards dot net
>
>