GPupdate

Discussion in 'Windows Server Systems' started by Cassady12, May 27, 2008.

  1. Cassady12

    Cassady12 OSNN One Post Wonder

    Messages:
    6
    We have a policy that gives permissions to MACHINE\SOFTWARE\Microsoft\HTMLHelp.

    This policy was set by a previouse admin. He took all permissions out then added domain users.

    Now we need SYSTEM to be added back in to install certain software packages.

    We added the correct permissions in. They will take effect on the PC only when removed from the domain and readded. Also if you make a change to the permissions on the local PC it seems like the policy will update after a reboot.

    GPupdate /force does not update this particular policy.
     
  2. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    is there a question in here somewhere?
     
  3. Cassady12

    Cassady12 OSNN One Post Wonder

    Messages:
    6
    How do we force this policy to update?
     
  4. Dark Atheist

    Dark Atheist Moderator Political User Folding Team

    Messages:
    6,376
    Location:
    In The Void
    there is in a round about way ;)
     
  5. Cassady12

    Cassady12 OSNN One Post Wonder

    Messages:
    6
    I have tried GPupdate /force from multiple domain controllers and some policy changes take effect but not the policy I am referencing.
     
  6. fitz

    fitz Just Floating Along Staff Member Political User Folding Team

    Messages:
    4,076
    Location:
    Chicagoland
    has the policy replicated to all domain controllers?

    Have you rebooted the computers? Some policy settings (especially on the computer policy side) only take effect on a reboot.
     
  7. ZeroHour

    ZeroHour ho3 ho3 ho3

    Messages:
    1,118
    Location:
    Scotland
    Do a gpresult and that will tell you what OU the pc is in and what the applied policies are.
    You can do this remotely as well using the group management console.
     
  8. kcnychief

    kcnychief █▄█ ▀█▄ █ Political User Folding Team

    Messages:
    16,948
    Location:
    Massachusetts
    If you do a gpupdate /force - shouldn't you get a message if a logoff/reboot is required for certain policies to apply? If all things have been applied, I'm guessing the changes haven't replicated to all DC's quite yet or properly.

    GPRESULT is a good way to go, see what the machine(s) in question are inheriting.

    Fitzy, please correct me if I'm wrong :)
     
  9. Cassady12

    Cassady12 OSNN One Post Wonder

    Messages:
    6
    The policy has been replicated to all domain controllers.

    The GPUpdate/ force does require a reboot, and the policy doesn't take on the pc.

    I have ran a GPresult and dumped it into a log but it just states the policy was updated but doesn't specify what securities were added.

    I have made other changes that do take effect with the GPupdate /force , but not this one.

    Thanks for your help.
     
  10. madmatt

    madmatt Bow Down to the King Political User

    Messages:
    13,312
    Location:
    New York
    Have you attempted to disjoin the computer from the domain and then rejoin it to the domain?
     
  11. Cassady12

    Cassady12 OSNN One Post Wonder

    Messages:
    6
    Yes, I have disjoined and rejoined and that works, but I have over 650 users and would like the policy to take effect without doing this on all users.