The following GPOs were not applied because they were filtered out

[mdfi13]

I have created a Restricted Group in AD (Computer Config ->Windows Settings -> Security Settings -> Resticted Groups).

I have given Authenticated Users and Domain Computers security access to this GPO. Since it is a Computer, not user policy, really the "Domain Computers" access should come into play.

When I run gpresult, it says the Computer Policy I created is filter out under the User Settings results. Under the Computer Settings, this GPO does not show up.

Any ideas would be greatly appreciated.

 

[ncotton]

The setting you have applied must be linked to an OU containing computer, not users.

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[mdfi13]

The OU I have linked it to contains both.

 

[gmail2]

Usually when a policy is filtered out, gpresult will tell you why

   The following GPOs were not applied because they were filtered out
   -------------------------------------------------------------------
       Local Group Policy
           Filtering:  Not Applied (Empty)

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau

 

[gmail2]

Sorry, wasn't quiet finished. Like I said, gpresult will usually tell you why. So maybe if you run it again and check what it says about that policy you might be able to diagnose the problem better.

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau

 

[mdfi13]

The policy name is "Local Power User Grant for Authenticated Users" and below are the results of gpresult. It is showing up under "User Settings" as Filtered, but not showing up at all under "Computer Settings", where it should be.

RSOP results for CRYSTALCLEAN\mattf on CCMATTFXP5 : Logging Mode
-----------------------------------------------------------------

OS Type: Microsoft Windows XP Professional
OS Configuration: Member Workstation
OS Version: 5.1.2600
Domain Name: CRYSTALCLEAN
Domain Type: Windows 2000
Site Name:
Roaming Profile:
Local Profile: C:\Documents and Settings\mattf
Connected over a slow link?: No


COMPUTER SETTINGS
------------------
CN=CCMATTFXP5,OU=CC_IT_GROUP,OU=CC_DEPARTMENTS, (192.168.21.0),O
=HCC,DC=CrystalClean,DC=local
Last time Group Policy was applied: 6/7/2006 at 9:09:12 AM
Group Policy was applied from: CCDC01.CrystalClean.local
Group Policy slow link threshold: 100 kbps

Applied Group Policy Objects
-----------------------------
Default Domain Policy
Websense
Synch Time Policy

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
Local Group Policy
Filtering: Not Applied (Empty)

The computer is a part of the following security groups:
--------------------------------------------------------
BUILTIN\Administrators
Everyone
BUILTIN\Users
NT AUTHORITY\NETWORK
NT AUTHORITY\Authenticated Users
CCMATTFXP5$
Domain Computers


USER SETTINGS
--------------
CN=Fields Matt,OU=CC_IT_GROUP,OU=CC_DEPARTMENTS, (192.168.21.0),
U=HCC,DC=CrystalClean,DC=local
Last time Group Policy was applied: 6/7/2006 at 9:09:29 AM
Group Policy was applied from: CCDC01.CrystalClean.local
Group Policy slow link threshold: 20 kbps

Applied Group Policy Objects
-----------------------------
IT Favorites
CC IT Printer Map
Default Domain Policy
Websense

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
PDFCreator Install
Filtering: Not Applied (Empty)

Local Power User Grant for Authenticated Users
Filtering: Not Applied (Empty)

2000 Pro SP4 Deploy
Filtering: Denied (WMI Filter)
WMI Filter: 2000 Pro Computers

Synch Time Policy
Filtering: Not Applied (Empty)

XP Pro SP2 Deploy
Filtering: Denied (WMI Filter)
WMI Filter: XP Pro Computers

Elgin WSUS Update for Workstations
Filtering: Not Applied (Empty)

Local Group Policy
Filtering: Not Applied (Empty)

 

[gmail2]

That means that the policy is outside of the scope of this particular computer. We can see from the above that both the computer and user account are in the same location in AD, so maybe you've disabled computer settings by accident? You should probably disable user settings seing that they're empty - it would make policy processing a little bit faster (although probably nothing noticible to users)

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau

 

[mdfi13]

Where do you enable and disable computer and user settings?

 

[mdfi13]

OK, disabled User Settings, but still does not show up in the "Computer Service" when performing a gpresult. I even did a gpupdate /force just to make sure I had the latest policies.

I did notice the only "Computer Setting" policies that are working are the ones in the root of the AD domain. The ones in any of the OU's are not working.

Hopefully this will help

 

[djtech2k]

Did you set it to be applied to "Authenticated Users" within GPMC? And link it to the OU containing the computers you want it to apply to?

 

[mdfi13]

I have:

Authenticated Users: Read (from Security Filtering)
Domain Computers: Read (from Security Filtering)
Everyone (just to try it): Read (from Security Filtering)

 

[gmail2]

This is strange ... I'm pretty sure if it was a permissions issue you'd still get the policy listed under the filtering section - it'd just say permission denied. Check the event viewer on the client, see if there's anything of relevance there.

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau