Announcement

Collapse
No announcement yet.

Access denied - Group policy issue

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Access denied - Group policy issue

    Hi,

    We have applied group policy for blocking usb devices for few machines in domain level roup policy of windows 2012 server. (computer config> administrative templates>system>Removable storage access> Removable disks).

    I had to give a user access to usb. I removed the computer from the ou in which the usb block policy was applied. Even after removing the computer, the user was still having issue accessing the usb device as he was getting access denied message. It was later found that only his usb device was getting the message "Access is denied" but other usb devices were accessible. Please help. We have removed usb blocking policies.

    Also, his usb device is working in other computers unlike his computer.

    Regards,
    Anish
    Last edited by Anishk; 22nd July 2013, 13:21.

  • #2
    Re: Access denied - Group policy issue

    Try to run gpupdate via command line on one of the Domain Controller, and restart affected users computer after that. If that did not help, try to check in the Device Manager on his computer if that device in the list of devices and if it is not disabled. If it is disabled - enable it.
    Another reason why the usb device could stop working on particular computer, if it conflicts with network drives letter, to fix it open the disk manager on his computer, find that usb in the list and manually assign it the different drive letter.

    Comment


    • #3
      Re: Access denied - Group policy issue

      Hi,

      Already tried running gpupdate on the server and restarted the affected pc.
      Will check in the device manager as well.


      Regards,
      Anishk


      =-------
      Originally posted by tAnk View Post
      Try to run gpupdate via command line on one of the Domain Controller, and restart affected users computer after that. If that did not help, try to check in the Device Manager on his computer if that device in the list of devices and if it is not disabled. If it is disabled - enable it.
      Another reason why the usb device could stop working on particular computer, if it conflicts with network drives letter, to fix it open the disk manager on his computer, find that usb in the list and manually assign it the different drive letter.

      Comment


      • #4
        Re: Access denied - Group policy issue

        Hi,

        Still no help. other computers are also facing the same issue for CD and usb access. Both devices are showing access denied when inserted. The policy was applied and later removed.

        Regards,
        Anish

        Comment


        • #5
          Re: Access denied - Group policy issue

          Did you edit the default domain policy?

          Check if the policy was applied to the machine or to individual users.

          It ought to have being applied at the domain users level such that when a user with admin rights or any other rights logs in into any machine he can use usb devices whereas a standard users cannot.

          Access denied means the policy is still there.Remember a local policy will take precedence over a domain level policy

          Comment


          • #6
            Re: Access denied - Group policy issue

            Hi Pope,

            We have created an OU A and created 2 sub ou's named userA and computerA inside that. the policies for usb block was created under computer configuration and then applied to the OU A which contain the sub ou's containing users and computers.
            There is no local policy for usb block in the local machine. The dword value in registry for usb is 3.

            Regards,
            Anish


            Originally posted by pope View Post
            Did you edit the default domain policy?

            Check if the policy was applied to the machine or to individual users.

            It ought to have being applied at the domain users level such that when a user with admin rights or any other rights logs in into any machine he can use usb devices whereas a standard users cannot.

            Access denied means the policy is still there.Remember a local policy will take precedence over a domain level policy
            Last edited by Anishk; 25th July 2013, 06:22.

            Comment


            • #7
              Re: Access denied - Group policy issue

              Hi,

              Finally got the solution. Went to device manager and uninstalled the driver for cd and usb devices. Restarted the machine and everything was normal as before.


              Regards,
              Anish

              Comment


              • #8
                Re: Access denied - Group policy issue

                Hi,

                Can we apply usb/cd block policy based on user instead of computer. Removable storage template is present in both user configuration and computer configuration.
                Also, what if in user config, it is set to allow and in computer config, it is set to deny ? which policy would override in this case ?


                Regards,
                Anish.


                ============

                Originally posted by Anishk View Post
                Hi,

                Finally got the solution. Went to device manager and uninstalled the driver for cd and usb devices. Restarted the machine and everything was normal as before.


                Regards,
                Anish

                Comment


                • #9
                  Re: Access denied - Group policy issue

                  Computer policies are applied when the computer starts, and user policies are applied when they log in, after the computer starts. Since the policy which applies LAST has priority, the user policy wins.
                  *RicklesP*
                  MSCA (2003/XP), Security+, CCNA

                  ** Remember: credit where credit is due, and reputation points as appropriate **

                  Comment


                  • #10
                    Re: Access denied - Group policy issue

                    Originally posted by RicklesP View Post
                    Computer policies are applied when the computer starts, and user policies are applied when they log in, after the computer starts. Since the policy which applies LAST has priority, the user policy wins.
                    Policy is applied every 90 minutes for both the user and computer. There are certain policies that only take effect at start up or logon. But for setting conflicts between the user and computer configurations, the computer takes precedence.

                    More info:
                    http://technet.microsoft.com/en-us/l...ssing_settings
                    http://technet.microsoft.com/en-us/l...(v=ws.10).aspx
                    http://technet.microsoft.com/en-us/l...(v=ws.10).aspx
                    Regards,
                    Jeremy

                    Network Consultant/Engineer
                    Baltimore - Washington area and beyond
                    www.gma-cpa.com

                    Comment


                    • #11
                      Re: Access denied - Group policy issue

                      Hi,

                      I have tried running the usb block policy by applying the policy to an OU containing user. the usb policy does not work while applying the policy to user. why then do we have the usb option in user configuration in addition to computer config ? Please help.

                      Comment


                      • #12
                        Re: Access denied - Group policy issue

                        What version of Windows do the users use?
                        Have you verified the policy is being applied?
                        Regards,
                        Jeremy

                        Network Consultant/Engineer
                        Baltimore - Washington area and beyond
                        www.gma-cpa.com

                        Comment

                        Working...
                        X