Chris-
Right, as Florian implied, your users should be getting background refreshes
of policy settings whenever they connect to the VPN (unless your VPN blocks
ICMP--true in some cases I've seen. In that case, then GP processing will
fail unless you disable slow link detection). However, they will never get
foreground policy. This is the policy that gets applied when a machine is
rebooted or a user logs on. Some policy areas, like Folder Redirection,
scripts and Software Installation, only run during a foreground event. So,
what's not clear to me is the type of settings your users are not getting.
If its Admin. Template settings, then they should get those in the
background when they dial into the VPN, assuming they are on long enough.
Keep in mind that, unless you are running Vista, normal background refresh
occurs every 90 min. plus up to a 30 minute random value. That means that
unless your users are on the VPN for on average, 120 min., they may miss the
background refresh interval. One thing you could do is reduce this interval
for these machines (using the Policy under Computer Configuration\Admin.
Templates\System\Group Policy) to see if that helps.
Darren
--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy
Manage Group Policy Backup and Recovery with the GPExpert Backup Manager for
GP!
Find out more at http://www.sdmsoftware.com/products.php
Visit the GPOGUY: http://www.gpoguy.com -- The Windows Group Policy
Information Hub:
FAQs, Training Videos, Whitepapers and Utilities for all things Group
Policy-related
Post by Chris WhiteThanks for the replies both!
I am already experiencing problems with this, and this is what made me
curious about how to achieve this properly.
I typically find out when a user comes back into the office, that I open up
the laptop and realise that some functions i blocked are still active on this
laptop. I then do a manual GP update when they are in the office to ensure
that they get the latest GP's.
The way the users connect typically is that they are already logged into
their laptops.
They open them up at home, dial the VPN connection from Network Connections
then drop their files onto their network shares for sorting and send/receive
any e-mails using Outlook 2003 (Cached Mode).
Not sure how they should connect for best effect, but VPN clients can use
our servers without any problems and do such things as browse the DFS shares
we have, ping a computer in the office, or print into the office etc. So to
me that says everything is forwarding to the SBS2003 server over VPN without
any problems.
--
Chris White
United Kingdom
Post by Florian Frommherz [MVP]Howdie!
Post by Chris WhiteHow can I ensure they get to update the Group Policies. At the moment all I
can ask is that they run gpupdate manually but thats a bit pathetic from a
company thats growing as fast as we are right now.
When they're connected via VPN and they can DNS and AD works healthy for
them, they should pick up Group Policy on a regular basis. Depending how
they're logging in to your network, they get only background refreshes
or the both fore- and background refreshes (Network-Dial-In option set).
What exactly are you experiencing? From your post it seems like your
outside-workers wouldn't get any Group Policy applied. Is there a
current issue with your people out there or is it just that you wanted
to get an advice on how to do this the best way?
cheers,
Florian
--
Microsoft MVP - Windows Server - Group Policy.
eMail: prename [at] frickelsoft [dot] net.
blog: http://www.frickelsoft.net/blog.