Cassady12

We have a policy that gives permissions to MACHINE\SOFTWARE\Microsoft\HTMLHelp.

This policy was set by a previouse admin. He took all permissions out then added domain users.

Now we need SYSTEM to be added back in to install certain software packages.

We added the correct permissions in. They will take effect on the PC only when removed from the domain and readded. Also if you make a change to the permissions on the local PC it seems like the policy will update after a reboot.

GPupdate /force does not update this particular policy.

fitz

is there a question in here somewhere?

---

Cassady12

How do we force this policy to update?

Dark Atheist

there is in a round about way

Cassady12

I have tried GPupdate /force from multiple domain controllers and some policy changes take effect but not the policy I am referencing.

fitz

has the policy replicated to all domain controllers?

Have you rebooted the computers? Some policy settings (especially on the computer policy side) only take effect on a reboot.

---

ZeroHour

Do a gpresult and that will tell you what OU the pc is in and what the applied policies are.
You can do this remotely as well using the group management console.

---

kcnychief

If you do a gpupdate /force - shouldn't you get a message if a logoff/reboot is required for certain policies to apply? If all things have been applied, I'm guessing the changes haven't replicated to all DC's quite yet or properly.

GPRESULT is a good way to go, see what the machine(s) in question are inheriting.

Fitzy, please correct me if I'm wrong

---

Cassady12

The policy has been replicated to all domain controllers.

The GPUpdate/ force does require a reboot, and the policy doesn't take on the pc.

I have ran a GPresult and dumped it into a log but it just states the policy was updated but doesn't specify what securities were added.

I have made other changes that do take effect with the GPupdate /force , but not this one.

Thanks for your help.

madmatt

Have you attempted to disjoin the computer from the domain and then rejoin it to the domain?

---

Cassady12

Yes, I have disjoined and rejoined and that works, but I have over 650 users and would like the policy to take effect without doing this on all users.