No announcement yet.

gpo processing

  • Filter
  • Time
  • Show
Clear All
new posts

  • gpo processing


    I have a question regarding the way GPOs get processed. I have a windows 2003 domain and all workstation are xp sp2. My OU structure is very simple. I have an OU called CompanyUSERS and all user are located in this ou. I have another OU for compuetrs and another ou for security groups. The way i implement user policy is by; linking all GPOs to the Compnayuser OU and then i filter all the GPO by security group. For the most part the gpos are mainly used to map dept shared drives, so basically i create a group for the dept, add the users to the group, then create a simple .bat script to map the dept shared drive and link it to the gpo. Then I remove authenticated users from the permissions of the gpo and add the secutrity group with read and apply group policy permssion. My questions is; when a user logs in, does the login look at all of the gpos in that OU regardless of whether they have permission to apply the policy? Attached is a screen shot of my gpo mmc.

  • #2
    Re: gpo processing

    Group Policy processing has two distinct phases:
    Core Group Policy processing. When a client begins to process Group Policy, it must determine whether it can reach a domain controller, whether any GPOs have changed, and what policy settings (based on client side extension) must be processed. The core Group Policy engine performs the processing of this in the initial phase.
    Client side extension (CSE) processing. Policy settings are grouped into different categories, such as Administrative Templates, Security Settings, Folder Redirection, Disk Quota, and Software Installation. The settings in each category require a specific CSE to process them, and each CSE has its own rules for processing settings. The core Group Policy engine calls the CSEs that are required to process the settings that apply to the client.
    its easier to beg forgiveness than ask permission.
    Give karma where karma is due...


    • #3
      Re: gpo processing

      ok... so based on your response the first time a new users logs in, he will look at all of the GPO, then determine which ones he has access to. The next time he logs in he will only process the gpos which apply to him and only look for changes on those specific gpos.