GpUpdate /force needed to apply GPO

[tvbruwae]

Hi

We created a simple user configuration GPO that sets a few registry keys under "HKCU/Control Panel/Desktop". When we assign the GPO to an OU and log on to a PC with an account from that OU, the policy is applied (as seen with GpResult). However, the registry keys remain intact with the old values.

Rebooting the PC does not help and neither does a "gpupdate /target:user /wait:0". Only a "gpupdate /force" actually overwrites the existing registry keys with the new values.

This problem makes the policy quite useless as it does not seem to have any effect without the "GpUpdate /force". Can this somehow be explained and /or troubleshooted?

Thanks for any tips!
Tim

 

[markdmac]

What registry keys are you setting? Have you checked "enforced" on the GPO?

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[tvbruwae]

The ADM template we are using looks like this:

CLASS USER

CATEGORY "Control Panel\Desktop"
KEYNAME "Control Panel\Desktop"

POLICY "SCRNSAVE.EXE"
PART "SCRNSAVE.EXE"
EDITTEXT
DEFAULT "%appdata%\bf.scr"
VALUENAME "SCRNSAVE.EXE"
END PART
END POLICY

POLICY "TileWallpaper"
PART "TileWallpaper"
EDITTEXT
DEFAULT "0"
VALUENAME "TileWallpaper"
END PART
END POLICY

POLICY "Wallpaper"
PART "Wallpaper"
EDITTEXT
DEFAULT "%appdata%\wallpaper.jpg"
VALUENAME "Wallpaper"
END PART
END POLICY

END CATEGORY

CATEGORY "Control Panel\Colors"
KEYNAME "Control Panel\Colors"

POLICY "Background"
PART "Background"
EDITTEXT
DEFAULT "255 255 255"
VALUENAME "Background"
END PART
END POLICY

END CATEGORY

So basically it sets the wallpaper and screensaver for the current user. We know there are default MS policies taking care of about the same parameters, but setting the registry keys has a slightly different effect that we really need.

We applied the policy to an OU holding one single AD account. There are no other (inherited) policies on that OU and this one active policy is enforced.

Thanks for the help!

 

[heyyunus]

Looks to me that the firewall at the client is preventing the GPO from being applied automatically.

Moreover also look at the group policy refresh interval settings


-------
Yunus

 

[markdmac]

I have personally always found the screen saver settings to be a little troublesome via GPO. My solution is to use vbscript to set the registry settings via login script.

If you are going to use a GPO, then make sure you have the screen saver copied down to each workstation.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[tvbruwae]

We'll try to get a reasonable answer from MS itself. If they define a default policy to set these options then at least it should work.. I'll keep you guys posted if we get an answer