GPO not applying on Windows 7 workstation

qwertyiop

I have a Windows 7 x64 laptop on a Windows 2003 domain. I noticed today that my logon script that runs on my XP machines wouldnt run on this laptop.
Since it wont run I cant get my drives to map or it to properly redirect the the Documents folder.

Does anybody have any suggestions on solving this?


I found a post on a MS forum saying the following: "Have found the problem and this is because the script is run elevated but the view in My Computer is not elevated (standard user). (so if you were not a member of administrators, it would appear to function normally)

The "Group Policy Scripts can fail due to User Account Control" section here explains it: Deploying Group Policy Using Windows Vista

There is a temporary not recommended workaround here: http://support.microsoft.com/default.aspx/kb/937624"

Hyper-Me

So is the user a local admin or not?

If you map a drive with elevation it doesnt show in My Computer because that window isnt running elevated, but you could still see it at an elevated command prompt.

qwertyiop

Hyper-Me wrote: »

So is the user a local admin or not?

If you map a drive with elevation it doesnt show in My Computer because that window isnt running elevated, but you could still see it at an elevated command prompt.

How can I solve this without making my users a admin? Currently their all Power Users

Hyper-Me

It would be solved if they were standard users.

Logon/Logoff scripts run with user credentials, elevated if they are an admin. Startup/Shutdown run as SYSTEM.

qwertyiop

Hyper-Me wrote: »

It would be solved if they were standard users.

Logon/Logoff scripts run with user credentials, elevated if they are an admin. Startup/Shutdown run as SYSTEM.

Is it really that simple?

Will that also be a reason why my Documents folder isn't redirecting?

Hyper-Me

Did you enable the GPOs to redirect My Documents to Documents?

qwertyiop

Hyper-Me wrote: »

Did you enable the GPOs to redirect My Documents to Documents?

Yes I did. Its currently working on my XP workstations. I have it set to redirect the Documents and Desktop.

the Windows 7 machine that im having this problem with is only redirecting the Desktop.

qwertyiop

The Logon script is now applying on my Windows 7 machine for my users but my Desktop and My Documents isn't. I know it works on my XP and Vista machines. Is there something different that I must do on for this to work on my Windows 7 x64 machine?

I dont see any errors on my event logs.

Hyper-Me

are you sure the entire policy has downloaded? you checked with gpresult or RSOP?

qwertyiop

Hyper-Me wrote: »

are you sure the entire policy has downloaded? you checked with gpresult or RSOP?

I just ran gpresult and both my domain and back office policies were applied.
Its working on my others Windows 7 machines and and locally when I log on as an admin.

qwertyiop

I just ran gpupdate /force and got the following:

"The Group Policy Client Side Extension Folder Redirection was unable to apply one or more settings because the changes must b
e processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before
the next startup or logon for this user, and this may result in slow startup and boot performance.
Computer Policy update has completed successfully."



Just to be clear If I log in as a Domain Admin then everything redirects like it should. Its not redirecting for my Domain Users.

qwertyiop

So its working for my domain admin accounts but none of my standard users

Hyper-Me

Just on one machine? Did you try reimaging it?

qwertyiop

Hyper-Me wrote: »

Just on one machine? Did you try reimaging it?

This is just one machine. I have 2 more Windows 7 x64 machines currently deployed and there working as their supposed to with the standard users.

qwertyiop

I cant explain how this was working on my other Windows 7 machines before this but I was finally able to figure out why my folder redirection wasn't working for my domain users. It turns out that it wasn't being enforced via GPMC.

crrussell3

So you blocking gpo inheritance on the OU where this user and/or computer account resides? Otherwise enforcing the gpo wouldn't make a difference. If you are blocking inheritance on a specific OU, maybe you need to take a step back and figure out why this was done? You should use that option sparingly, if at all in a properly designed AD structure and gpos. Maybe look into security filtering instead?

Hyper-Me

crrussell3 wrote: »

So you blocking gpo inheritance on the OU where this user and/or computer account resides? Otherwise enforcing the gpo wouldn't make a difference. If you are blocking inheritance on a specific OU, maybe you need to take a step back and figure out why this was done? You should use that option sparingly, if at all in a properly designed AD structure and gpos. Maybe look into security filtering instead?

Enforcing also makes the enforced GPO the top of the list for processing. At least on a 2008 domain.

I know from experience.