We had the same problem and Ken's suggestion is right on the money - you
must be able to ping the domain controller to get the GPO settings.
To verify connectivity with the domain controller use DCDIAG -
http://www.microsoft.com/resources/documentation/Windows/2000/server/res
kit/en-us/Default.asp?url=/resources/documentation/Windows/2000/server/r
eskit/en-us/distrib/dsbi_add_oywa.asp
- Hitesh
-----Original Message-----
From: Ken Hoover [mailto:ken.hoover@yale.edu]
Sent: Wednesday, December 15, 2004 2:09 AM
To: Peter Rodger
Cc: focus-ms@securityfocus.com
Subject: Re: Group policy help needed!!!
Make sure that the clients can successfully ping a domain controller
because the clients will do this as a test to verify connectivity before
attempting to update group policy. If the ping fails for any reason
(even though other traffic flows freely) then group policy will not be
updated on the client.
We discovered this after we tried blocking ICMP ping last year.
- Ken Hoover
Peter Rodger wrote:
Hi, all
I pushed out audit policy and event log policy through
group policy to all our servers (70). All server in
the Servers OU.
None of them got policy. I ran secedit many times.
Can anyone point me why and the right direction?
We are in windows 2K and XP environment.
Thanks,
Peter
--
Kenneth J. Hoover
Systems Programmer
Yale University ITS AM&T x2-1260
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
