Cross Forest GPO Question...

-

hi all,

i ask question configuring cross forest gpos.

in summary.  have environment 2 forests in it.

a resource domain/forest (pcresource.com) has ad computer objects in , computer based gpos. 

and managed ad forest has user ad objects , user based gpos in (users.net)

there one-way trust (non transitive) pcresource.com users.net

cross forest gpo support has been enabled via 1 of computer based gpos in resource domain/forest.

when user01 logs onto pc-dev-01 (a windows 10 pc) the computer based gpos applying successfully.  user based gpos not appear applying successfully.

running rsop gpo management console or gpresults locally on pc gives report seems indicate user based gpos applying successfully.  when settings checked manually not set.  or if setting changed not reapplied @ next logon.

most common examples of ie11 homepage, auto proxy script , shortcuts placed on desktop.

i'm rather confused this.  because if user based policies not applying various reports should indicate this.

any assistance gratefully received,

hi iwebb,

>>because if user based policies not applying various reports should indicate this.

agree view.

besides, try to export gpos user.net , import pcresource.com workaround.

also, me check following location on user.net: computer configuration/administrative templates/system/group policy/allow cross- forest user policy(ensure enabled)

more detailed steps, please see kb below:

https://support.microsoft.com/en-sg/kb/823862

in addition, below kb helps troubleshooting issue:

how troubleshoot group policy object processing failures occur across multiple forests

see: scenario 2: cross-forest gpo application fails if icmp  not enabled

https://support.microsoft.com/en-sg/kb/910206

symptoms

all user group policy, including have been security filtered on user accounts or security groups, or both, may fail apply on domain joined computers.

see kb below:

https://support.microsoft.com/en-sg/kb/3163622

be sure current logon uses has appropriate read permission.

lastly, suppose following thread said right:

https://social.technet.microsoft.com/forums/en-us/b6276c11-bcb6-4fae-ae6a-d01c8c596a42/cross-forest-user-policies?forum=winservergp

best regards,

andy

please remember mark replies answers if , unmark them if provide no help.
if have feedback technet subscriber support, contact tnmff@microsoft.com.



Windows Server  >  Group Policy



Comments

Post a Comment

Popular posts from this blog

CRL Revocation always failed

-
hi all, i try configure radius server nps, somehow certificate authentication client failed with reason: reason = revocation function unable check revocation because revocation server offline. then check certificate client, certutil -f -urlfetch -verify client7.cer, result follow: issuer:     cn=entca     dc=intra     dc=domain     dc=co     dc=sg subject:     cn=computer.intra.domain.co.sg cert serial number: 1c5b00de000000000041 dwflags = ca_verify_flags_allow_untrusted_root (0x1) dwflags = ca_verify_flags_ignore_offline (0x2) dwflags = ca_verify_flags_full_chain_revocation (0x8) dwflags = ca_verify_flags_console_trace (0x20000000) dwflags = ca_verify_flags_dump_chain (0x40000000) chainflags = cert_chain_revocation_check_chain (0x20000000) hcce_local_machine cert_chain_policy_base -------- cert_chain_context -------- chaincontext.dwinfostatus = ce...
Read more

Failed to query the results of bpa xpath

-
Image
i have new server installed hyper v, iis , domain services roles on it.  i checking event log , see warning multiple times, idea how rid of it?? failed query results of bpa xpath: microsoft/windows/fileservices:$reports$\*\result.xml:/resultdatabase/result. error: device attached system not functioning., last error: system cannot find path specified.. follow me on twitter <<< levalencia blog <<< hi, similar issue discussed in forum: to rid of warnings: 1. go dashboard 2. click on add roles , features 3. click next "before begin step" 4. select "role based or feature based installation" , click next 5. select given server server pool , click next 6. in server roles step make sure following checked:   file , storage services > file , iscsi services > file server, click next 7.click next through rest of steps , install server role 8. rerun bpa scan described earlier for more information please refer foll...
Read more

0x300000d errors in Microsoft Remote Desktop client

-
we use rd connect home users office. @ server side remote desktop gateway configured on 2008r2 server. experience following:   for years worked fine, starting last year users apple macbook experienced connection errors after new version of microsoft remote desktop in app store , automatic update. after couple of weeks error disappaered when new updates released. since 6 8 weeks problem again. because don’t have macbook cannot reproduce problem.   starting couple of weeks samsung s6 experiencing problems, here version 8.1.37.135 installed, error displayed is: can’t connect tot remote pc because remote desktop gateway server temporaraily unavailable. try connecting later or contact network administrator assistance. error code  0x300000d   because has worked fine years expect issues on client can configuration error on gateway server.   who pin point real cause?   however, testing other rd gateway server works ok settings identically....
Read more