RE: [ActiveDir] GPO being denied

[Cothern Jeff D. Team EITC]

I am using GPMC and RSOP.  Inside GPMC when I do a group policy result and look under summary.  Group policy objects.  Denied GPO’s   IT says under the reason. Access denied (security filtering).   But the user is in the group that has apply policy setting.   This policy of course is a computer side policy that I only want applied if certain users log in.  and Yes I have loopback set on the computer with merge.   Jeff     From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of SysPro Support Sent: Thursday, May 19, 2005 6:36 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] GPO being denied   Hi Jeff,   Can't think of anything immediately. When you say " Its saying security filter" are you getting that from the UserEnv log, or somewhere else?   I always find it useful to activate full logging and then read the UserEnv.Log in %windir%\debug\usermode to find out what is happening (maybe you have already done this). We have a free tool that helps display the log in a (slightly) more meaningful way. Or you can email me the log offline and I will have a look to see if I can see anything.   Here is a reference to activating the logging: http://www.microsoft.com/resources/documentation/Windows/2000/server/reskit/en-us/Default.asp?url=""> and here is a link to our free software http://www.sysprosoft.com/index.php?ref=activedir&f=policyreporter.shtml Alan C      Policy Management Software:- http://www.sysprosoft.com/index.php?ref=activedir&f=pol_summary.shtml ADM Template Editor:- http://www.sysprosoft.com/index.php?ref=activedir&f=adm_summary.shtml ----- Original Message ----- From: Cothern Jeff D. Team EITC To: ActiveDir@mail.activedir.org Sent: Friday, May 20, 2005 7:10 AM Subject: [ActiveDir] GPO being denied   Ok here is scenario.   I have a Terminal Server with a Policy assigned to it.  Thru this policy user are unable to have any local peripherals redirected and used thru TS.   Now a requirement has come up for a few users to have this ability.  So I created a policy that allows this to happen.  I set that policy on the OU the TS system is in.  I also set the group as the security filter for it.  When the test user account logs into the system the policy that is suppose to change the setting to allow the printer redirection is being denied.  Its saying security filter.  But I checked and the user is in the allowprinter group and that group is the one that is in the security filter and under advance both read and apply gpo are checked.  I don’t understand why the user is denied from that policy.  Any ideas?     Jeff