User First Login/Profile/GP

[cchsrball]

Windows XP Pro Sp1 PCs. Two domains. Both are W2K3 DCs, recently upgraded from pure NT4 domains where we make extensive use of system policies stored in netlogon shares in several files. One running with NT4Emulator keys so that system policy is still being applied, other is full Group Policy. We notice that any domain user account that does not have a romaining profile source specified will, as long as a local profile does not exist (never before logged in on PC), not get all policy settings applied, that some are not seen until second login. If a roaming profile source is defined, with NT4-emulated domain, all is well. But in "full" GP domain, same behavior in that some settings not seen until second login. We do see the "missing" entries (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet
Settings\AutoConfigURL) in the ntuser.pol file. Maybe we're just not fully understanding hw all works, but one would surmise that Group Policy settings are meant to be applied at any login. We've set to "always wait for network at computer startup" GP, but no change.

You're on the right track...

but link a GPO containing that policy setting at the DOMAIN level and enforce it on. In other words.. *MAKE SURE* you're getting that setting.

Also.. You need to figure out:

1. Which GPOs are being applied and which aren't.
and
2. Inside the GPOs being applied.. which settings are being applied and which aren't.

That will get us toward the goal.

Use GPRESULT to figure it out.

[cchsrball]

OK, will investigate and see what I find. Thanks.

I checked. When running through the GP Modeling Wizard (that user on that PC), or even running RSOP.MSC on the workstation (by that user after that first login, when we don't see the registry setting applied we're targeting), both report that the policy application is successful, as expected, that we should be seeing the change. When in fact the registry is NOT set that way. GPRESULT of little help in that didn't show specific registry value, just the key heading, and only those set to 1 it looked like. After running RSOP.MSC, I ran GPUPDATE for user. Registry now applied.