Chapter 1 (green book) calc.exe example

[thrint]

I have gone over this one twice in a great deal of detail but calc.exe will not launch at login

I have verified my path to the executable and followed all of the instructions to a "T" and it just does not work on XP or Win 7. All the other examples work fine just not the one to launch calc.exe.

I have a domain set up as all Hyper-V VMs on a Win2008R2 server No access to the outside world but they all communicate with each other with no problem.

The "network" consists of
(all service packs and patches applied to all VMs)
one XP VM
DC: Win 2008R2 server
two Win7 x64 VMs one as the management station and one as a client station

Any suggestions on where to look to find what I might have done wrong or is there an error in the book?

[thrint]

I have fiddled with this a lot, tried loopback processing on, moved the GPO around in and out of various OUs with no luck.
If I use the group policy modeling wizard it shows that the launch calc.exe at login is applied. But when I go to the workstation and run a gpresult /R it is NOT applied as below:

C:\Windows\system32>gpresult /R

Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001

Created On 8/31/2011 at 9:37:10 AM


RSOP data for CORP\frizzo on WIN7 : Logging Mode
-------------------------------------------------

OS Configuration: Member Workstation
OS Version: 6.1.7601
Site Name: Default-First-Site-Name
Roaming Profile: N/A
Local Profile: C:\Users\frizzo.CORP
Connected over a slow link?: No


COMPUTER SETTINGS
------------------
CN=WIN7,OU=HR_Computers,OU=Human Resources,DC=corp,DC=local
Last time Group Policy was applied: 8/31/2011 at 9:31:38 AM
Group Policy was applied from: DC.corp.local
Group Policy slow link threshold: 500 kbps
Domain Name: CORP
Domain Type: Windows 2000

Applied Group Policy Objects
-----------------------------
Launch calc.exe at login
Default Domain Policy
IE Default Home Page

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
Hide Screen Saver Option
Filtering: Not Applied (Empty)

Local Group Policy
Filtering: Not Applied (Empty)

Prohibit Changing Sounds
Filtering: Not Applied (Empty)

The computer is a part of the following security groups
-------------------------------------------------------
BUILTIN\Administrators
Everyone
BUILTIN\Users
NT AUTHORITY\NETWORK
NT AUTHORITY\Authenticated Users
This Organization
WIN7$
HR-Computers
Domain Computers
GET - Auto launch calc.exe
System Mandatory Level


USER SETTINGS
--------------
CN=Frank Rizzo,OU=HR_Users,OU=Human Resources,DC=corp,DC=local
Last time Group Policy was applied: 8/31/2011 at 9:33:59 AM
Group Policy was applied from: DC.corp.local
Group Policy slow link threshold: 500 kbps
Domain Name: CORP
Domain Type: Windows 2000

Applied Group Policy Objects
-----------------------------
Prohibit Changing Sounds
IE Default Home Page
Hide Screen Saver Option

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
Launch calc.exe at login
Filtering: Not Applied (Empty)

Default Domain Policy
Filtering: Not Applied (Empty)

Local Group Policy
Filtering: Not Applied (Empty)

The user is a part of the following security groups
---------------------------------------------------
Domain Users
Everyone
BUILTIN\Administrators
BUILTIN\Users
NT AUTHORITY\INTERACTIVE
CONSOLE LOGON
NT AUTHORITY\Authenticated Users
This Organization
LOCAL
High Mandatory Level

C:\Windows\system32>

[jeff_longley]

the policy IS being applied - Remember that GPO's have two halves, a User half and a Computer half.
Look at the results for the computer and you can see that policy is being applied. The reason is not applied to the user is because the user half of the policy is empty.

Does that make sense?

Going to the policy itself, I'll have to ask the obvious question, but have you checked Notepad is in the location you've specified? On a windows 7 client, you can get much granular logging of what's going on - Does anything look amiss in the event logs?

[thrint]

I tried that too, I linked the same GPO to the users OU in addition to the already linked GPO in the computers OU and there is no change. Assuming that is how you do it.

And it is always good to check the path. I am using %windir%\system32\notepad.exe (and also tried calc.exe like in the book) and if I paste that directly into a command line on any computer that command works. So the path is right.

Also on Page 62 of the book it only has you link it to the computers OU and not the users. And I have verified that the computers and users are in the proper OU. I have done the GPUPDATE /FORCE and rebooted the VMs to no avail.

If I were more experienced with GPOs I would swear there is a step missing in the book, but I am not and rely on your kind suggestions, thanx!

[jeff_longley]

ok, not near my lab at the moment so can't test the example in the book.

Just thought of one thing - Have you got the "wait for network" settings applied? I realise your a newcomer and that's probably all double dutch, but what can happen is that the machines get to the logon screen before group policy has had a chance to apply itself fully; You can delay it by telling the system to wait for group policy to apply before letting you logon.
So, create a new group policy, call it something usefull like "wait for network". In the computer settings, drill into Computer Configuration\Administrative Templates\System\Logon ( done from memory -think it's in there!). Apply the always "wait for computer to start up..." policy and exit.
Link that GPO to the OU in which your WIN7 machine is living in, then give your windows 7 machine a reboot and see what happens.

Or alternatively, create a new Group policy, but user the user settings for auto launching a program. Link that GPO to the OU where your test user lives and see if it works from a user side.

[thrint]

I tried the wait for network to no avail.

The setup is a Server2008R2 with Hyper-V installed and then 4 VMs using only the internal Hyper-V network acting as the domain. So they are completely isolated from my production network. One DC, a Win 7 Management Station and then a Win7 and XP client system. They can all talk to each other and are all joined to the domain. Not sure if that setup has anyting to do with it but thought I would bring it up.

Win7 machine experiencing a problem and I have to rebuild it now, but it did not work on the XP VM with the same GPO linked to the users OU. I assume that the launching of a program at login should work the same in XP as Win7 and can use the same GPO.

So there is an "HR" OU in the domain and then 2 OUs below that one for users and one for computers. I placed the client VMs in the computer's OU and the user in the Users OU along with a security group he is also in. Which all seems to be exactly the way the book recommends.

I've run the gpupdate /force command AND rebooted the VMs and that one won't apply. One wonders if Jeremy monitors this or someone who has his contact info can pass this along for a sanity check... Big thanks to Jeff

-Steve

[jeff_longley]

Setup all sounds good; Did you trying changing it to be a user policy?

I should have some time today (got to add some NIC's to my lab!) so I'll run through the example in the book and give you some feedback.

I'm sure Jeremy looks in but it's been Australian Tech ed this week, so he may be "out of the loop"

[thrint]

OK this is going to sound like a silly question but how do you change it to a user policy?

It is in an OU that is applied to only users but I see no setting anywhere that allows me to change the type from user to computer, etc.

[jeff_longley]

Fear not: the ONLY silly question is the one you never ask. Jeremy covers it in the book (think it's page 5!) but I'll give my brief version.

Every group policy is both a computer policy AND a user policy. It's what you configure and where you place it that matters.

So, if you open up a new blank group policy, you'll notice it's got two distinct sections. The upper section is called computer configuration and holds ALL the policies you can apply to computer. The lower part is the User Configuration and holds the user policies.

Keeping things simply, if you configured a load of computer policies, you need to link it to an OU that contains computers, or have it higher up the hierarchy that it'll be inherited. Likewise, User settings need to applied to OU's containing users to get applied.

Some sections appear duplicated - For example, "Computer Configuration\Administrative templates\system\logon\Run these programs at user logon" is the same as "User Configuration\Administrative templates\system\logon\Run these programs at user logon". The difference is that one is applied to computers (so ANYONE who logs onto a computer touched by that policy gets it) and the other is applied to a User.

Does that make things a little clearer?

[thrint]

OK maybe I should have said I feel silly asking it, but thank you for clearing that up.

So I create a new GPO and under User instead of Computer I have calc.exe set to run at login. I link it to the correct OU (the Human resources -> HR Users OU) and refresh the policy on the Win7 and XP boxes AND reboot....

Nope, nada, nyet, nosireebob!

sigh...