Local GPO refreshes outside of refresh interval
Parhez Sattar
We are experiencing an unique (may be not?) situation where local group
policies are getting reapplied only after what seems to be certain changes on
the AD GPO. In this case, we are talking about one particular policy:
User Configuration\Windows Settings\Internet Explorer Maintenance\URL\Home
Page URL.
On a few dozen machines that we rolled out using an OS (XP SP1) image, we
had implemented this particular policy via the Local Policy, setting the
users' hompage to be http://intranet. Subsequently, we decided to not force
a homepage on users and therefore, we never set this policy on the AD GPO.
Since then we have edited the AD GPO several times, never any settings within
the Internet Explorer Maintenance section, however. It appears that the only
time (this time) we edited the AD GPO in the IE Maintenance section, it
caused the local policy for that section on all machines to be read and
loaded again, causing the users to have http://intranet as their homepage
which was still set via local Group Policy. Un until this time, the
machines have be restarted dozens of times, users logged off and on hundreds
of times, and their customized homepages stayed on the machines in question.
Even though we knew that group policies are refreshed every 90 minutes on
the workstations, the 60 or so workstation that got the homepage set via
local group policy never complained as users could change the http://intranet
to whatever and the change stuck. Therefore, we figured that particular
policy must just set the initial page if set locally and allow changing to
something else, and only enforces the homepage if set via AD GPO.
TROUBLESHOOTING:
I checked the refresh interval settings in the AD GPO. I checked the local
settings for group policy processing. We even changed the homepage for some
users and set policies in other sections of the AD GPO and did a GPUPDATE
/FORCE (and let others just auto refresh at 90 mins) and the problem did NOT
reoccur. So, it doesn't seem like the local policy at every 90 minutes
setting the homepage to be http://intranet.
QUESTION:
What causes local group policies to be "reapplied"? Does GPO "refresh"
literally mean that all "set" policies are reapplied every 90 minutes on the
workstations, whether those policies are "set" locally, at different levels
of the AD (site, domain, OU, etc.)? If so, when we change other (non IE)
polcies on the AD GPO, why didn't those trigger the local group policies to
be reapplied, therefore, why didn't the homepage on those machines get set to
http://intranet? If policy1 (i.e. Homepage) in section1 (i.e. Internet
Explorer Maintenance) of the AD GPO changes, will that force the local GPO's
all policies of section1 to reapply?
I know this is a long message and that your time is precious. I appreciate
you taking the time. Thanks.
Richard Sweetnam
The trick with GPO's is that if they are disabled it just means that they
are no longer applying. Any setting previously used will stick until they
are changed via the GPO or local policy.
Enabling the homepage option again and blanking out the URL will delete the
setting on client machines.
Hope this helps,
Richard
"Parhez Sattar" <Parhez...@discussions.microsoft.com> wrote in message
news:72AE195C-FF15-4BFF...@microsoft.com...
Dmitry Korolyov [MVP]
particulary setting should be applied only if it was changed in GPO, or if
it should apply EVEN if the value defined in GPO did not change since the
last update. This might be your issue.
--
Dmitry Korolyov [d_...@removethispart.mail.ru]
MVP: Windows Server - Directory Services
"Parhez Sattar" <Parhez...@discussions.microsoft.com> wrote in message
news:72AE195C-FF15-4BFF...@microsoft.com...
Parhez Sattar
Not Configured, the local GPO's HomePage setting will be removed? I am not
sure if I understand how that would work :-(
Also I still don't understand why settings some other policies within the IE
Maintenance section of the AD GPO caused the local GPO's related section to
reapply, causing the local GPO's HomePage setting to be applied on those
workstations. Any thoughts?
-Parhez
Parhez Sattar
Where is this checkbox? I looked through my GPO's Windows Settings section
and couldn't find any such checkbox. Thanks.
-Parhez
Dmitry Korolyov [MVP]
Administrative templates\System\Group Policy, "Internet Explorer Maintenance
policy processing", the checkbox "process even if the group policy object
have not changed"
--
Dmitry Korolyov [d_...@removethispart.mail.ru]
MVP: Windows Server - Directory Services
"Parhez Sattar" <Parhez...@discussions.microsoft.com> wrote in message
news:CA6EE2E0-F10B-4E01...@microsoft.com...