User Accounts Not Getting Lastest GPOs

[anthonymeluso]

In my six plus years I have never seen this type of problem before and thought maybe this community could help me understand it.

We had two users who were not getting the latest user GPOs. At first I thought it was a profile corruption. So I deleted their profiles and had Windows automatically recreate them on next logon. Still the problem persisted. Not just on one machine but any machine they logged onto. No errors where found in event view either. Up in till a few days ago the account appeared to be working fine for the user.

To fix this problem I had to delete both the user's profile and the AD user account. Upon next login, everything worked and the latest GPOs were in affect.

My question is what could have been broken with AD user account that I had to recreate it? Could it had to do with the users SID or something else.

To me this a scary situation as I always believe AD user accounts to be very stable.

 

[teqmod]

I had a similar issue where the XP machines were not waiting for the network connection and the users were logging in under cached credentials. It would sometimes take a day or so longer than normal for the GPO to apply correctly but it did eventually get applied.

 

[anthonymeluso]

Is there anyway in group policy to force it not to cache? I read some stuff on group policy history records in the registry. Would clearing them out helped me out?

 

[acl03]

Were these users in any different security groups from the rest of the users?

Were they in a different OU?

Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!

 

[anthonymeluso]

No same security group same OU as everyone else. Since the issue first occurred it has happened to another person. The rest are fine. I just want to make sure this is not a larger problem that I don't see yet.

Thanks.

 

[acl03]

I'm not sure what caused your issue with these 2 users, but if it happens again, run gpresult when it happens and you can see if the policy is getting applied...and if it isn't, it may tell you why.

Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!

 

[anthonymeluso]

That's the funny thing. These users are prevented from accessing the command prompt. Even when I change the setting in the GPO it never gets changed due to the original problem. So I never get to see gpresults. However, the old group policy sticks.