My first tip for troubleshooting Microsoft's Group Policy is this: Put yourself in the right frame of mind. Get into
'State' as Anthony Robbins would say. Believe that you are going to solve
80% of all computer problems are caused by a simple fault. In the case of Group Policies, check that the user or computer is in the OU that you are testing. By default, all computers are in the
Computer folder. That means that if you set a policy at an OU, the computer settings will have no effect on any computers still in the original computers folder.
A variation of this problem is, that people do not realize that Windows Server 2003 Domain Controllers have their own special policy, again find the Domain Controller container and configure that default policy. I
would advise against moving the Domain Controllers into an OU.
So, if you logon as a user and none of your policy settings apply - check to
see that the user account is in the same OU as the policy you are testing.
Incidentally, when troubleshooting, this is why I always include one or two trivial computer settings along with
main user setting that
I am testing. If the trivial computer settings work, but the one I am testing
fails, then that pin points where the fault lies.
There are two factors in Group Policy synchronization. Active directory replication from the FSMO master to the other DCs. Also FRS (file replication services) replicating the very
group policies under the sysvol\sysvol folder.
Be ruthless, logon an as an administrator at the Windows 2003 server, which holds the FSMO PDC Emulator master and see if that cures the problem.
Perhaps you only have 'Read only' permission.
Full control is needed to open the GPO.
Monitor Your Network with the Real-time Traffic Analyzer
The main reason to monitor your network is to check that
your all your servers are available. If there is a network problem you
want an interface to show the scope of the problem at a glance.
Even when all servers and routers are available, sooner or later you will be curious to
know who, or what, is hogging your precious network's bandwidth. A GUI
showing the top 10 users makes interesting reading.
Another reason to monitor network traffic is to learn more about your
server's response times and the use of resources. To take the pain out of
capturing frames and analysing the raw data, Guy recommends that you download a copy of
free Real-time NetFlow Analyzer.
SolarWinds' Config Generator is a free tool, which puts you in charge of
controlling changes to network routers and other SNMP devices.
Boost your network performance by activating network device features
you've already paid for.
Guy says that for newbies the biggest benefit of this free tool is that
it will provide the impetus for you to learn more about configuring the SNMP
service with its 'Traps' and 'Communities'. Try Config Generator now - it's
The modern group policy method of drive mapping does not require any
knowledge of either VBScript or PowerShell. In Windows Server 2008 you can launch the
GPMC and configure Drive Maps in the Preferences section.
See more on Group
Policy Drive Maps.
Summary of Troubleshooting Group Policy Settings
While it has some risks, I would logon to a Domain Contoller then get a
very simple, innocuous policy working for an administrator. It's
amazing what a little success can do. From there create a test OU
with a test user and experiment.
If you have just set a policy and it does not work, check what refresh
settings are necessary, logoff --> logon, or reboot. The next level
of troubleshooting is to see if it's a latency problem, you applied the
Policy, but the setting has not reached the client machine. Hence my
tip of trying the policies on the domain controller.