GPMC SP1 reports wrong name for "winning GPO"!

[DrVelocity]

I am running into a very strange problem with GPMC RSoP reporting.

GPMC (SP1, running on Windows XP SP2, Vista is not an option) is reporting the wrong "winning GPO" for various Internet Explorer Maintenance (IEM) Settings.

In the simplest case the scenario is as follows:

A newly imaged XP SP2 machine.

The corporate image used has a Local Policy setting a proxy AutoConfiguration URL in IEM.

Before joining the imaged machine to the domain, the Local Policy is edited to "Reset Browser Settings" in IEM.

We verify that the install.ins disappears from:

C:\WINDOWS\SYSTEM32\GROUPPOLICY\USER\MICROSOFT\IEA K

We note in passing that C:\WINDOWS\SYSTEM32\GROUPPOLICY\GPT.INI still indicates that the Local Policy includes the IEM Extension, even though there are no IEM settings present.

The machine is joined to the domain by the local administrator account.

Next a domain nonAdmin user account, in an OU subject to a GPO with the desired IEM settings, logs on.

The GPMC console reports the correct _SETTINGS_ for IEM items, including the AutoConfiguration URL, but reports LOCAL POLICY as the winning GPO.

We review on the client:

\\NEWMACHINE\C$\Documents and Settings\<domainuser>\Application Data\Microsoft\Internet Explorer\Custom Settings\Custom0\install.ins

Here we find the GUID correspoding to our "really winning" GPO, and the settings from that GPO.

How is it that GPMC SP1 can report the name of the winning GPO as "Local Policy" instead of the name of the actual winning GPO.

[jeremym]

Can you upload a screenshot ?

[steven-hurtado]

I think I hit a similar issue and while the thread is 2+ years old, it seemed worth it to try and follow up on.

In our existing jumbled mess of policies, there is a policy named "Admin Departments Policy" with a setting enabled (User Config/Admin Templates/System/Prevent access to the command prompt) preventing access to the command prompt for authenticated users applied to a specific OU.

However, our IT Staff have an exception where their own policy named "ITS Policy" specifies that policy setting as disabled, which should allow access.

When I run the Group Policy Results from the GPMC as myself (a member of IT with the ITS Policy applying), it reports that the winning GPO is "ITS Policy" but that the setting is still enabled, and thus my access is still prevented.

Looking in the advanced view of the GPMC Group Policy Results, it reports that the setting is enabled per the orginal "Admin Departments Policy."

Any ideas. I realize there might be a lot more information that would be helpful, and I can try to put together some screenshots if that's useful.

Thanks,
-- Steven

[trekker]

If you can log in as you on the machine having the problem and give us the output of a gpresult, that would be helpful. /h if it is a Win7 box /v if it is an XP box.