preferences from disabled GPO applying to XP clients!

[j r brewin]

Hi,

I'm currently deploying windows XP service pack 3, and group policy
preferences CSEs via WSUS. The primary business driver behind us doing
this is to set power profiles on our 500 or so client devices.

Not all PCs have yet installed SP3, and reporting on whether or not
the CSEs have deployed sucessfully within WSUS is flakey at best. We
use LANDesk here, so i can also check for registry keys on client
devices to get a better indication of success rate of CSE deployment
(generally it's pretty decent).

Anyway, whilst i wait for client devices to deploy i thought would
have a tinker around with group policy preferences to see what could
be accomplished. I created and linked a GPO to an OU, set it to be NOT
enabled, and added some power options to the GPO. Generally this is
the way i create GPOs, and have never had issues with it before.

a day or two after doing this i started to get reports from our
service desk that power options were being configured on devices. I
have double checked the GPMC on windows 2003 (wer're on a primarily
2003 domain, with 1 2008 DC), and 2008 and have found the GPO to be
disabled.

In worse cases, a device had the settings from the disabed GPO even
though the user was not in the OU that the GPO was linked to, and the
fact device was in an OU that had blocked inheritence and loop back
enabled on (and didn't have the GPO linked to).

I've been scratching my head as to why this is.. SP3 vs SP2, CSEs not
deploying correctly, GPP not working with disabled GPOs, etc.. but i'm
totally at a loss..

does anyone have any suggestions on what could be going wrong?

[j r brewin]

I suspect this might be being caused by SP3 and / or a combination of
the the CSEs and XMLLite not being installed. Has anyone else seen
this behaviour whereby a GPO with preferences are applied to some
clients despite the GPO link being disabled?

regards,

jethro brewin,

Post by j r brewin
Hi,
I'm currently deploying windows XP service pack 3, and group policy
preferences CSEs via WSUS. The primary business driver behind us doing
this is to set power profiles on our 500 or so client devices.
Not all PCs have yet installed SP3, and reporting on whether or not
the CSEs have deployed sucessfully within WSUS is flakey at best. We
use LANDesk here, so i can also check for registry keys on client
devices to get a better indication of success rate of CSE deployment
(generally it's pretty decent).
Anyway, whilst i wait for client devices to deploy i thought would
have a tinker around with group policy preferences to see what could
be accomplished. I created and linked a GPO to an OU, set it to be NOT
enabled, and added some power options to the GPO. Generally this is
the way i create GPOs, and have never had issues with it before.
a day or two after doing this i started to get reports from our
service desk that power options were being configured on devices. I
have double checked the GPMC on windows 2003 (wer're on a primarily
2003 domain, with 1 2008 DC), and 2008 and have found the GPO to be
disabled.
In worse cases, a device had the settings from the disabed GPO even
though the user was not in the OU that the GPO was linked to, and the
fact device was in an OU that had blocked inheritence and loop back
enabled on (and didn't have the GPO linked to).
I've been scratching my head as to why this is.. SP3 vs SP2, CSEs not
deploying correctly, GPP not working with disabled GPOs, etc.. but i'm
totally at a loss..
does anyone have any suggestions on what could be going wrong?