i am having trouble implementing group policy on my home lab.

I have win2k server DC and win2k client.

Here is what i did:-

Created an OU
Added two users to the OU
In the OU's properties i selected Group Policy tab and created a new GP.
I edited this to 'hide the Internet explorer icon from the desktop'.

I then ensured that my two users had read and apply GP permissions for the policy, and also selected 'Block policy inheritence'

I also used the secedit/refreshpolicy command.

What else do i need to do? At the moment the IE icon is still present when i log in as one of these users?

__________________
Jonboy The Brave
I Love Pies

Report this post to a moderator

What is the output of NSLOOKUP on the client?

__________________
Bye for now,
Tharg

MCSE 2003, A+, Net+

Report this post to a moderator

I have found that group policy can be effected (affected - still don't know the difference!! ) if your DNS is not set up correctly.

Just me 2¢.

Report this post to a moderator

NSLOOKUP:

Client:-

server: unknown
address: 192.168.0.2

***unknown can't find nslookup:non-existent domain


Server:

server: localhost
address: 127.0.0.1

__________________
Jonboy The Brave
I Love Pies

Report this post to a moderator

Looks like a DNS misconfiguration - did you maybe use the wizard (DCPROMO) to configure DNS?

The wizard misconfigures DNS (nice one MS!). It will create a root zone in DNS - in other words the server will think it is a root server (and there are only 13 of them...)

So, *possibly* a "root zone" that shouldn't be in DNS.

MS have an article on this:
http://support.microsoft.com/?kbid=291382

NSLOOKUP output should end up looking like this on client and server.

Default Server: server1.tookaytest.com
Address: 192.168.0.2

Check DNS for a "." zone - if it exists under forward lookup zones in DNS, delete it.

Next create a reverse lookup zone if you don't already have one.

__________________
Bye for now,
Tharg

MCSE 2003, A+, Net+

Report this post to a moderator

i did use the DCPROMO command, and there was a "." forward lookup zone, i have now deleted this an created a reverse look up zone, but i am still getting the same nslookup reading....

__________________
Jonboy The Brave
I Love Pies

Report this post to a moderator

SORTED!!!

nice one tharg, i wouldn't have known to remove the "." zone.

I discovered that the reason it still wouldn't work was that the client was configured to recieve DNS server address automatically, when i entered in the static address of the DNS server, everything worked fine.

The group policy that i originally set up is now fully operational!

thanks again

__________________
Jonboy The Brave
I Love Pies

Report this post to a moderator

Excellent!

Do you think MS should do a KB on
"Why DCPROMO messes up DNS"

__________________
Bye for now,
Tharg

MCSE 2003, A+, Net+

Report this post to a moderator