Report prints GPO, but cannot find to edit!

I've taken over another server and I can print the GPO (Default Domain Policy) and the report shows several settings. However, when I edit and drill down, there are no entries!!  ARG!  BTW, the settings are active and working.

System: 2008 R2/64 bit Standard, single DC.

UPDATE: XP clients seem to work fine. Having problem with Win 7 PRO 64 bit 4GB Ram Intel I5

Anyone have any idea either where the setting are coming from?  Or where I might find them to edit them. And/or why they are not showing when attempting to edit?

There are only 2 GPO's listed (default Domain, and Default Domain Controller).  Here's the snippet from the GPO report:

User Configuration (Enabled)
Policies
Windows Settings
Remote Installation Services
Client Installation Wizard options
Policy Setting
Custom Setup Disabled
Restart Setup Disabled
Tools Disabled

Folder Redirection

Documents

Setting: Basic (Redirect everyone's folder to the same location)
Path: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Options

Grant user exclusive rights to Documents Disabled
Move the contents of Documents to the new location Enabled
Also apply redirection policy to Windows 2000, Windows 2000
server, Windows XP, and Windows Server 2003 operating systems Enabled

Policy Removal Behavior Restore contents

Music

Setting: Follow the Documents folder

Pictures

Setting: Follow the Documents folder

Videos

Setting: Follow the Documents folder

Administrative Templates

Policy definitions (ADMX files) retrieved from the local machine.

Control Panel/Personalization

Policy Setting

Comment

Path to Visual Style: 

 



September 23rd, 2013 7:54pm

How did you create this report? Run "gpresult /h report.html" or use gpmc, this will tell you the originating GPO.
Free Windows Admin Tool Kit Click here and download it now
September 23rd, 2013 11:21pm

Thanks. I used the GP management console initially.

I just went back and ran the gpresult command as you indicated.  Just as before, the winning settings are deemed to be located in the Default Domain Policy, other settings were listed as the Default Domain Controller Policy and firewall settings as the Local Policy.  The ones I care about are in the Default Domain Policy.  However, when I edit it from the management console, there are no settings listed in ANY of the categories the report indicates!  I checked the other settings too in the Domain Controller Policy, same thing!

September 23rd, 2013 11:54pm

Strange... "gpupdate /force" - any messages? And the Group Policy Eventlog - any hints?
Free Windows Admin Tool Kit Click here and download it now
September 24th, 2013 10:53pm

Thanks for hanging with me Martin...

I ran the GPUPDATE /FORCE command... here's the results...

C:\Users\administrator.TCFN>gpupdate /force
Updating Policy...

User Policy update has completed successfully.

The following warnings were encountered during user policy processing:

The Group Policy Client Side Extension Folder Redirection was unable to apply on
e or more settings because the changes must be processed before system startup o
r user logon. The system will wait for Group Policy processing to finish complet
ely before the next startup or logon for this user, and this may result in slow
startup and boot performance.
Computer Policy update has completed successfully.

For more detailed information, review the event log or run GPRESULT /H GPReport.
html from the command line to access information about Group Policy results.

Certain User policies are enabled that can only run during logon.

=========================================================

This same message appears as event ID 1112

The Group Policy Client Side Extension Folder Redirection was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.

This was sandwiched between this one (1502)

The Group Policy settings for the computer were processed successfully. New settings from 3 Group Policy objects were detected and applied.

and this one (1503)

The Group Policy settings for the user were processed successfully. New settings from 1 Group Policy objects were detected and applied.

No other events for group policy were recent. 

September 25th, 2013 9:04am

Is your Goal to Edit the currently used GPO's . If yes please install RSAT tool on WIn XP system where you see the group policy being active and deployed .

Once you have the GPeditor on the system login with your Domain Admin account and check if you can edit the same .

Please update and let me know if there is any more help required .

Free Windows Admin Tool Kit Click here and download it now
September 25th, 2013 9:52am

The 1112 is ok when running gpupdate... still strange. Are you familiar with ldap? Then do a search for GPOs with attribute gPCUserExtensionNames containing the FR CSE GUID {25537BA6-77A8-11D2-9B6C-0000F8080861}

...and remove the GUID pair in square brackets (the other one is the mmc snapin guid for FR).

September 26th, 2013 12:33am

I have remote access to the server only at that location and will have to make some arrangements to get access to one of the workstations to conduct that study.  I will not be able to do so until next week and will reply then as I am out of the office.

Thanks. Steve.

Free Windows Admin Tool Kit Click here and download it now
September 27th, 2013 8:10am

Martin,

Here's the registry entry you requested.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions\{25537BA6-77A8-11D2-9B6C-0000F8080861}]
@="Folder Redirection"
"ProcessGroupPolicyEx"="ProcessGroupPolicyEx"
"DllName"=hex(2):66,00,64,00,65,00,70,00,6c,00,6f,00,79,00,2e,00,64,00,6c,00,\
  6c,00,00,00
"NoMachinePolicy"=dword:00000001
"NoSlowLink"=dword:00000001
"PerUserLocalSettings"=dword:00000001
"NoGPOListChanges"=dword:00000000
"NoBackgroundPolicy"=dword:00000000
"GenerateGroupPolicy"="GenerateGroupPolicy"
"EventSources"=hex(7):28,00,46,00,6f,00,6c,00,64,00,65,00,72,00,20,00,52,00,65,\
  00,64,00,69,00,72,00,65,00,63,00,74,00,69,00,6f,00,6e,00,2c,00,41,00,70,00,\
  70,00,6c,00,69,00,63,00,61,00,74,00,69,00,6f,00,6e,00,29,00,00,00,00,00
"DisplayName"=hex(2):40,00,66,00,64,00,65,00,70,00,6c,00,6f,00,79,00,2e,00,64,\
  00,6c,00,6c,00,2c,00,2d,00,32,00,36,00,31,00,00,00

I also noticed gpupdate messages in the event log too after I triggered the gpupdate message I reported on previously...

The description for Event ID 0 from source gupdate cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

If the event originated on another computer, the display information had to be saved with the event.

The following information was included with the event:

Service stopped


Steve

September 27th, 2013 8:20am

I wasn't talking about registry - I was talking about LDAP aka Active directory ;-)

Something like

dsquery * -filter "(&(gPCUserExtensionNames=*-77A8-*))" -attr displayname name gpcuserextensionnames

This will result in something like

  Usr HTPC                           {723B63BE-AF24-4DC8-84B4-6E2E5074AED0}    [{25537BA6-77A8-11D2-9B6C-0000F8080861}{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F73-3407-48AE-BA88-E8213C6761F1}]                                                                                 

So here we have a GPO "Usr HTPC", that resides in dsa.msc in System\Policies\{723B6...

Open up dsa.msc, Enable View - Advanced output, navigate to the above DN, edit the Container properties, locate gPCUserExtensionNames and edit this attribute, remove [{25537BA6-77A8-11D2-9B6C-0000F8080861}{88E729D6-BDC1-11D1-BD2A-00C04FB9603F}] and you should be fine.

Free Windows Admin Tool Kit Click here and download it now
September 28th, 2013 5:02am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics