GPO Startup Script Won't Apply to Groups

[heresahandle]

I have a COMPUTER startup script (.CMD extension) that I'm trying to apply to a group of computers in AD on my W2K server through a startup script GPO. It just imports a registry setting for this new Daylight Savings Time problem.

The GPO doesn't apply to computers that are in a group that is in the OU, but if I put individual computers in that OU it applies the GPO just fine. I have tried security groups and distribution groups with the same results for each.

Is there something I'm missing? Is it even possible to apply GPO's groups?

 

[Odissey]

Remember that Group Policy applied to OU not group!
When it applied it may be filtered for group membership.
In your case you may try to apply policy to domain level, uncheck "apply policy" for Authenticated users Group and check for your computers group

WBR, Vadim V. Petukhov,
vadimp@yandex.ru

 

[heresahandle]

The group is IN the OU. Wouldn't that still apply the GPO to the group?

 

[heresahandle]

And what exactly falls under "Authenticated Users"? Does that mean everyone who successfully logs into the domain?

 

[Odissey]

Hi heresahandle!
Once more: by default GP apply to all computer objects in OU. When you place computer object into the OU, it apply policy, isn't it? For reading Computer part of policy group "Authenticated users" have "read" and "apply policy" rights on GPO by default. If you want apply policy to selected computers only, you must uncheck "apply policy" right from "auth users" and add it to your group.
When computer started it request policies which linked to its OU and all higher level OU. If computer object not in the OU to which GPO linked, policy not apply to it anyway. If computer object in OU and "apply policy" right checked for it or its group, policy would be apply. "Auth users" group include all domain computers by default. If you not delete "apply policy" right from this group, policy would be apply to ALL computer objects in this OU, not to your group only.



WBR, Vadim V. Petukhov,
vadimp@yandex.ru

 

[markdmac]

Modify the security of your GPO and add the group to it. Be sure to check the Read and Apply Policy settings in the security list.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript