Hi, this is Jeremy Moskowitz from GPanswers.com and today we are going to cover some common Group Policy troubleshooting techniques. That is the trick about Group Policy. It usually works pretty darn well. But every once in a while, it is usually us the humans that mess stuff up the computer is doing just fine. It is something that we did.
I want to cover today some common things that I still do. I make mistakes all the time, and hopefully you make them less than I do. Long story short, I am going to cover some things that hopefully are quick fixes. Things you might want to just check as you are going through something that does not work perfectly, what are some things you can try out and look for.
Let me go ahead and get Active Directory Users and Computers up here. This is a very common thing that I forget do, I simply forget to have the right Users in the right locations. If we have our East Sales Users we want to make sure that the User we are talking about is actually in the right OU in the first place. If we are trying to troubleshoot something with EastSalesUser1 you have to make sure he is hanging out under East Sales Users and he did not somehow get moved or obliterated. That is the first thing.
The second thing, and I have this problem all the time, is I forget to move my particular computer accounts where they are supposed to go. I forget to move \\win7computer1, or whatever, into my East Sales Desktop. Even when I do that, I then forget to sometimes reboot the client machine just to make sure he has the latest, greatest, Group Policy Settings. I make that mistake a lot too.
Other things that are very common, you can see I have GPO456, it is linked over to East Sales Users and everything should be fine, right? Everything looks perfect. Well, you have got to really, really squint here, but you will notice that the Icon link has been dimmed down. In fact, just to prove a point. Let me show you, I will call this, Another GPO Link, if you look the difference between Another GPO Link icon and GPO456 you will see that GPO456 has been disabled. The link has been disabled so the powers that it had underneath the hood are not going to do anything. I make that mistake all the time, especially because it is just so hard to see, it is just a quick visual thing and it is just really difficult.
Another mistake I see a lot – I do not tend to do this one too much – is that if you click on Another GPO and click on the details, you will see, sometimes all settings are disabled. If you have half of the GPO disabled using the computer half disabled or the user half disabled or you have the whole thing disabled, you might see some weird results go on, on your client machine.
Those are the top issues that I see that are most usually preventing people from getting Group Policy to work the way they expect. Again, it is not usually the computers fault; usually it is just something we forgot to do.