Win2k Server Group Policies

[statiatech]

I am a Windows 2000 newbie. I am setting up a small network here at the office. For now I have one domain controler.
I am working with policies and can not seem to get them to take effect when I log on to another machine.

To test this I went in to active directory and shut down control panel for the domain. I did a refresh and loged on as administrator on the server and it worked fine...I could not get control panels. When I tried logging on to a client system as administrator, I had no problem getting control pannel to work.

Is there something that needs to be done to make policies take effect on all Windows 2000pro systems on the network?

thanks

[BipolarBill]

You need a group policy (GPO) for the domain workstations. Add the users to the domain group. You need to apply it and override local settings.

[statiatech]

Ill give that a try today...thanks for the info. I have a black and blue mark on my forhead and a dent in my desk :)

[statiatech]

Ok...I think I need more specific info. I tried to figure it out today without any luck...it is all starting to look the same. I have tried Microsofts site...still looking there.

Thanks

[BipolarBill]

To be fair, this stuff is extremely complicated. One thing you can do is use Internet Explorer Administration Kit (IEAK):

http://www.microsoft.com/windows/ieak/default.asp

Beware that it's another bag of worms. It does, however, allow you to rule out things like desktop changes, Regedit, the Run dialog and Control Panel.

I will do some more research for you.

[statiatech]

thanks...

I am reading some other things on the Microsoft site.

See the big problem is I need to learn this stuff and I have the books to do it but I really need some classes. I live on an Island in the Caribbean and there is no easy way to take the classes I need. The books are good but when I follow the steps to get Group Policies up and running it does not work. I think there is some other small thing I need to do to get it to work....

More later...

[BipolarBill]

On further review, it appears that you cannot, as administrator, deny yourself the control panel on another local machine via a GPO. You can, however, configure Local setting on that PC the same as you did on the server.

Let me ask you something:

Why would you want to deny the Control Panel to Administrators? That's like denying executive privileges to yourself while President.

[BipolarBill]

Have you added the Computers to the Group?

[statiatech]

Well that was the way I was testing to be sure it worked on the server...because it is a Domain Controler you can not log on as any other user. I just didnt know that it would not carry over to the workstation. When I make a test account and add it to a test group or organization unit I cant test to make sure the policies work because I cant log in to the server...but when I log on to a workstation with the test account nothing sticks...aslo it seems now the the roaming profile is not working....not sure if this is related to my group policies problem. Do roaming profiles for the administrator account work on workstations or does it not apply the same as group policies does not apply on workstations?

[statiatech]

I have not added the computer(workstation) to the group...that may be the problem then? So any computer on the network must belong to the workgroup?

[statiatech]

err....I mean...If I have a OU I must add any computer(workstation) to it that is to work with group policies? I missed that part in the book I guess.