GPO Exceptions not applying - Randomly!

[dsmithmcse]

Within our envronment we have groups of machines on our factory floors that are exempt from our domain screen saver policy. We have the machines in a group and the deny permission is set for "Apply Group Policy" for the group. Everything has been working great until recently. We not have poskets of systems, at different locations, where the machines are now getting the screen saver policy. We are in the porcess of upgrading our DCs to Server 2K8R2 from Server 2K3R2. Some of the machines having issues are older XP SP3 machines. Is there any known issue where XP machines will not apply GPOs froma 2008R2 DC? We have about half of our DCs upgraded to 2K8R2. We have stopped our upgrading project until we can get a handle on this GPO issue. We currently have 10DCs @ 2K8R2 and 13DCs @ 2K3R2. All of the FSMO role holders are on 2K3R2 boxes. Any insight to this issue will be greatly appreciated.

Thanks in advance

Smitty

[trekker]

The Sysvol folder is just a repository for your policies. As long as it is replicating properly between DC's, it is just that, a repository. You might want to check the RSoP or gpresult on those machines to see what is actually applying to them.

As another option... If you have a group of machines that have a user policy that doesn't need to apply to anyone that logs in, you could put those machines in a sub-OU and use Group Policy loopback processing in merge mode to override the policy for anyone logging in.

[dsmithmcse]

Trekker - thanks for the input, but I have tried all of your suggestions before my original post. The RSOP and gpresult both show the deny via security which is correct. The issue is that even though the deny is in effect the machines (not all, just some and mainly XP SP3 boxes) are still getting the screen saver policy. I have also been unable to duplicate the issue with a similarily confogured XP SP3 VM that is in the same OU and a membed of the group that us used to prevent the screensaver from being applied. We have also forced GPO updates via gpupdate /force and bounced the boxes several times. - We are still scratching our heads with this issue.

Thanks fo your input