Roaming Profiles and GP mystery

[rayhughes]

What a great site this is!! I am hoping someone can give me the old "your shoe lace is untied" answer to my problem. My setup is as follows: High school lab with 20 computers, all xp pro. Windows 2003 server configured with roaming profiles for users. Everything is working fine, except when I try to use GP. It only will apply to the DC computer, none of the client machines. I loaded a test version of 2003 on a new machine (just in case I screw up my active server) and the problem is still there. None of the settings I make in GP will apply to users, only administrators on the DC computer. I hope this is a simple fix....it has been driving me nuts!!

[Gentle Giant]

Hi Ray,

It almost sounds like the GPO is attached to the DC container. I have a couple questions . . .

Are the lab computers in the 'Computers' AD container or another one?
Are the users in the 'Users' AD container or another one?
In the event viewer of any of the lab machines, do you have any critical errors in the Application Event log?

[rayhughes]

The only GPO linked to the DC is the Default Domain Controllers Policy.
All Users are in the "Users" folder.
All Computers are in the "Computers" folder.
There is an error "userenv" and the message says it cannot get the domain controller name for my computer network, and thus GP is haulted.

[rayhughes]

This seems to be the problem, the computers cannot resolve the domain controller name. I will configure the dns to do this.

[Gentle Giant]

Hey Ray,

You will not be able to apply any group policy to the users in the USERS container and computers in the Computers container (they are CN-class containers and by default will not accept GP).

Best bet is to make two other OUs, say "Lab Users" and "Lab Computers" and move exisiting users/computers into the appropriate OU. Once this is done, you can attach GP to those OUs, which will solve your problem.

Hope this helps, please let me know,
Mason

P.S. I am attaching this article URL in the hope it will be of assistance as well.

http://support.microsoft.com/default.aspx?scid=kb;en-us;324949

[rayhughes]

Just a little ahead of you on that. I did it this afternoon and it worked!! My students will be sooooo happy. The only problem now is that it is still affecting my Domain Controller. I cannot figure out why. I did a RSoP and a gpresult and it is saying I have links to GPOs that I got rid of....I will keep at it and figure out why.

Thanks!!!

[Gentle Giant]

Hi Ray,

Glad to hear things have straightened out!

Just a thought on your DC, did you force a GP update (gpupdate /force? And, in my experience, at times you just need to restart to get all the unwanted GP fingers out. Go figure.

Take Care,
Mason

[rayhughes]

Thanks for the help, Mason. The problem was a combination DNS config on the clients (my fault) and a GPO on the server that was linked and applied wrong....(my fault again). I had been using gpupdate /force to test the client configs and the server configs but it was gpresult that showed me the light. Seems quite simple now, but mult-problems on different machines can drive you crazy. Everything is working fine now and again, thanks a bunch!