Settings reports fails to "build"

[blowtorch]

Hi All,

I was hoping to get a bit of input from you all regarding some strange behaviour within the GPMC and reporting policy settings.

Here is the break down of the situation:-

Win 2k3 domain controller with sp1, fully patched.
Single Domain Forest

On the DC (with IE enhanced security enabled)
Open GPMC, create and link a new GPO anywhere in the domain.
Go to User Configuration - Windows Settings - IE maintenance - Security - Security Zones and Content Ratings.
Import your Zone Settings and acknowledge the IE enhanced security warning.
Edit anything (I used trusted zones and changed "initialize and script ActiveX controls not marked as safe - enabled"
Close the GPO
Click on the GPO or link in the tree view and select the settings tab to run the report and see your IE security settings.

This should display nicely.

Now repeat on a Windows XP workstation (without IE enhanced security) creating a different GPO in the same manor and try to get a report from the settings tab.

It does not work for me, I get the following error:-

An error occurred while generating report:
An unknown error occurred while the HTML report was being created.

I have tried this in our live environemnt at work and on a test-bed built from scratch with the same results. Googling the error lead me to discovering that if I manually edit the install.ins file within the GPO in sysvol to change importSecZones=1 to importSecZones=0, the report builds but does not show me any of the zones settings. This seems to be linked to the IE enhanced security features. There does not seem to be a lot of info on this out there, only a couple of newsgroup posts hinting at a possible bug. Nothing confirmed that I can find though.

Has anyone else had this issue and if so have they found a work around / fix???

The settings are applied to clients within the policy scope, it seems that you are just unable to report on them, making it pretty difficult to see what is applied, the only way seems to be to edit the policy. (which means you have to re-import the settings)

Any comments most welcome, please feel free to tell me if I am being a plank, this one is now driving me nuts!!!!!

Thanks

[scriven_j]

Hi,

I was wondering if you found a solution to this as I have experienced this same problem.

Everything was working fine accessing GPMC via Windows 2003 server. I installed it on my Windows XP machine and got the error message you mentioned. Now I find that if I use it on Windows 2003 too I get the same message.

I have recently been making some security changes also, but didn't think I had changed anything that could affect this (I could be wrong though......).


Jon

[jshapiro]

I just experienced the same behavior. In my case, I was using the GPMC on my WinXP box to modify an existing policy for IE. I went into Security Zones and Content Ratings and imported the current security zones. Then I added one site to the local intranet zone. After doing this, I tried to run the report. That's when I got the error.

An error occurred while generating report...

I just verified that I got the same error with at the GPMC on my Win2003 DC.

I have IE7 on my computer. I wonder if this messes things up.

By the way, the policy change I made is working, so it is likely that the report mechanism is all that is broken.

[scriven_j]

Snap!!

I am also running IE7 and have recently imported some security zone stuff as I realised that the previous security zone stuff had not been working (as I had previously done this on the Windows 2003 Domain Controller and this was not compatible apparantly).

So three people with the same problem. Anyone got a solution?


Jon

[jshapiro]

I fixed my problem. It definitely appears to be related to IE7. Here's what I did. I went to my DC (the only other machine that has the GPMC and does not have IE7). I uninstalled the IE Enhanced Security. I then went into the GPMC console and imported the settings as I'd done at my XP computer. Voila, I can now get reports at both that machine and at my XP box.

Obviously, IE7 is not fully compatible with that policy. Is there something I can install on a machine so that it can admin both IE6 and IE7?

By the way, as far as the Enhanced Security for IE (6) goes, MS warns that if users log on with machines that may or may not have Enhanced Security, then you should really create 2 different GPOs, and then import the settings from a machine with the security into one GPO and without the security into the other.

Only my servers have the enhanced security, and I don't find it too livable for day-in-day-out use.

[scriven_j]

OK - I'll give that a try too.

Can you uninstall the enhanced security without a reboot?


Jon

[jshapiro]

Yes. It is a quick uninstall. You'll find it in Add/Remove Windows Components.

[scriven_j]

I have tried this fix but am still having problems. Whenever I try and use Group Policy Results or Modelling, I get the same HTML error.

Any more ideas?

Is yours working completely now?


Jon

[jshapiro]

In my case, modeling is now working, and clicking on the Settings tab of policies also works.

Although I'm back up and running, my original question remains. How do we manage policies in a mixed environment of IE6 and IE7? Even if we cut over to IE7 (which we can't yet), seems like I can break GP. There has to be some way of uploading new templates to GP to support IE6/IE7.

[scriven_j]

Mine is working again now. I am not really sure how I sorted it out (though I followed the instructions for what you did which didn't seem to work) but I have been playing with RSOP.MSC and also went into Help & Support, Support, Advanced System Information, View groups policy settings applied. One of these things seems to have sorted it out but I am not sure which :roll: !

I'll keep you posted if I learn anything else and vice-versa.

Surely there must be a seperate ADM for IE7 though?


Jon