Unable to remove user from lock down GPO

[gardnepw]

When I remove a particular user from the lock down group and log in to a workstation as the user it is still locked down. I have tried this on more than one workstation. The user is definitly removed from the group in AD, and even made the user an administrator with out sucess. I have 45 other users at this site and all others do not exibit the problem. I don't want to recreate the user unless I have to. I have a Widows 2000 SBS and two Citrix XP boxes on 2000 server. Any suggestions...
Thanks, Park

 

[minxca]

your removed from group or OU?

 

[gardnepw]

Yes I can remove the user from the lock down group which is defined in a GPO. Once removing the user and logging back into the workstaion it is as they were still in the group.

 

[markdmac]

Have you tried refreshing the policy onthe workstations after making the change?

On an XP machine run the following from a command line:
GPUPDATE /FORCE

On a Win2K machine it is two commands:
SECEDIT/REFRESHPOLICY MACHINE_POLICY /ENFORCE
SECEDIT/REFRESHPOLICY USER_POLICY /ENFORCE

You can run GPRESULT to determine what policies are hitting the user. This will help you isolate where the lockdown is coming from. make sure the user is not a member of any other groups that the policy is being set on.

I hope you find this post helpful. Please let me know if it was.

Regards,

Mark

 

[gardnepw]

Due to the hurricanes here in Florida, I have not been able to follow up on this. The network is being moved due to roof damage. Thanks for all the help and as soon as I get their network back up I will try the suggestions and reply back.
Thanks,
Park