Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Determining If the Policy Has Been Applied

Determining if the policy in question has been applied up front can save you hours of troubleshooting. After all, if a DNS problem prevents the policy from being applied at all, then there is no sense in analyzing policy hierarchy or the details of GPO configuration. Likewise, if everything's copasetic in the network, you'll need to evaluate the GPOs in question. Finally, a visual inspection of a complex Group Policy configuration and hierarchy can still leave you unsure of whether a specific GPO will be applied to a specific account. The answer is to determine if the policy has been applied. If the policy has been applied, you may still have to do some visual inspection to determine its effect. If the policy has not been applied, your quest to determine this may show the reason why. For example, a GPMC Group Policy Results scan may show why a GPO is not applied to a specific account.

To determine if a Group Policy has been applied, use GPMC. If GPMC is not available or cannot be used, the Resultant Set of Policy MMC snap-in can be used on Windows Server 2003 and Windows XP, and the GPResults Windows 2000 Resource Kit Tool can be used on Windows 2000.

Use GPMC

The easiest way to determine if a policy has been applied to a user or computer is to use the Group Policy Management Console (GPMC) to create a Resultant Set of Policy report using the Group Policy Results Wizard for the specific user or computer. In the report, select the Summary tab; then use the show statement next to Group Policy Objects to reveal the Group Policy Objects Applied and Group Policy Object Denied sections of the report, as shown in Troubleshooting Networking Problems" and "Troubleshooting Active Directory and FRS Replication" related problems sections of this chapter. If the GPO does appear in one of the lists, review the "Troubleshooting Group Policy Object Design" section of this chapter.

To create a Group Policy Results report, follow these steps:

If the GPOs that should be applied are being applied, you might be able to find the problem right away by looking for the use of a double negative. This happens when a setting starts with the word "disable." If you disable it, you have effectively enabled the setting. It's easy to misunderstand how a setting works when it starts with a negative word, and you should always scan the applied GPO settings in the report to see if any double negatives are the cause of your problem. Figure 9-6 shows an example of a setting that might be misapplied because it begins with the word "disable." The setting, Disable machine account password changes, can be used to prevent the automatic password change for computer accounts. By default, computer account passwords are periodically changed. If a computer is offline for a significant amount of time, its account password can be out-of-synch with that known to the Active Directory. To avoid this situation, this Group Policy setting is available. However, many administrators will disable the setting. They think they have stopped the automatic password change, but instead, they have just explicitly enabled it. They should have set this Group Policy setting to "enable."

Use Resultant Set of Policy

The Resultant Set of Policy Wizard is available as an MMC snap-in for both Windows Server 2003 and Windows XP. To run the wizard on Windows XP, follow these steps:

To run the wizard on Windows Server 2003, do the following:

WARNING: Don't Limit Testing to One Item

If a single item that you believe should be applied by the GPO is not listed, do not assume that the GPO has not been applied. The problem could be with your assumption. The GPO could be configured incorrectly so that this one item is not showing up in the report. Check other items before assuming that the entire GPO has not been applied. Better still, install GPMC and use it whenever possible because it does indicate directly whether a GPO has been applied.

Use GPResult

GPResult is a native Windows Server 2003 command-line tool and a Windows 2000 Resource Kit tool that can be downloaded from the Microsoft site (http://www.microsoft.com/windows2000/techinfo/reskit/tools/existing/gpresult-o.asp). The Windows 2000 version of GPResult must be run while locally logged on to the computer as the user to test. The following information can be obtained:

Computer-specific information such as OS and group memberships.

User-specific settings such as group membership and security privileges.

A list of GPOs and their details.

The last time policy was applied and from which domain controller the policy was downloaded. If this varies by user or computer, the information will be reported.

IP security settings.

Downloaded scripts.

Folder redirection settings.

Applied registry settings.

The Windows Server 2003 version of GPResult can be run against a remote computer. Table 9-2 lists the command syntax.

Issuing the command GPResults without switches will provide minimal information for the currently logged on user on the local machine. The GPOs applied are listed, but not the settings applied. Use the /V switch to see the list of settings each GPO applies. The following command runs GPResult on the local computer and provides verbose results for the logged on user. The results will be logged to the GPResult1.txt file.

Gpresults /V > GPResult1.txt

The following listing is the first bit of the nine-page report generated:

Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0
Copyright (C) Microsoft Corp. 1981-2001
Created On 9/12/2004 at 2:58:39 PM
RSOP data for CHICAGO\Administrator on REGALINN : Logging Mode
---------------------------------------------------------------
OS Type:                     Microsoft(R) Windows(R) Server 2003, Enterprise Edition
OS Configuration:            Primary Domain Controller
OS Version:                  5.2.3790
Terminal Server Mode:        Remote Administration
Site Name:                   Default-First-Site-Name
Roaming Profile:
Local Profile:               C:\Documents and Settings\Administrator
Connected over a slow link?: No
COMPUTER SETTINGS
------------------
CN=REGALINN,OU=Domain Controllers,DC=chicago,DC=local
Last time Group Policy was applied: 9/12/2004 at 2:57:35 PM
Group Policy was applied from:      regalinn.chicago.local
Group Policy slow link threshold:   500 kbps
Domain Name:                        CHICAGO
Domain Type:                        Windows 2000
Applied Group Policy Objects
-----------------------------
Default Domain Controllers Policy
Default Domain Policy