Group Policy Only Applies Once?

[CameronPoe]

Hey y'all

I have just started using GPO's and I would like to run a scenario past you.

My AD server environment is Windows 2003 and my target users have Windows 2000 SP4.

I've created a GPO for some basic customization of Internet Explorer 6(i.e. the IE homepage). I've assigned the GPO to an OU that my target users are a member of too.

The first time my users logged on they got this policy applied and the settings were delivered as expected. However, this GPO only appears to have applied once as the users can change the settings in IE, reboot, logon on again, and still have their own specific settings in place.

Is this standard behaviour of GPO's? that they apply once but never apply again? I thought that they'd be reapplied everytime at logon?.

I'm aware that I can edit my GPO settings here and disable the user's ability to change settings in IE but I'm more interested in understanding how GPO's are actually deployed.

Thanx for your time

Cam.

 

[Tricky100]

Nope they always apply. There is a time default. Group policy refresh interval under User Config\Admin Templates i believe, and also when they reboot.

What happens when you do a force gp update on a client?

 

[tfg13]

Are you "enforcing" that particular policy? Within Group Policy Management Console (GPMC, which I hope you are using as it makes group policy management so much easier), right click the Group Policy, and ensure that there is a check mark for "enforced".

 

[kmcferrin]

And if you're worried about them changing the IE settings, you can always use that policy to grey out those options or remove those tabs from IE. Then they can't change them.

 

[bran2235]

Refresh time period should effect him because he said users are rebooting and then logging back in... (right?)

 

[tfg13]

bran2235, hence the reason I stated to check for "enforced". If the policy is not enforced, users will be able to change the settings, and upon reboot/policy refresh, the changes made by the user will remain because the policy is not "required" to change them to the GPO.