Windows "Group policy" problem

[dddave]

I'm glad to hear this. It's sure a lot easier to have it fix itself. Did you uninstall the updates and either leave it or reinstall them, or did it just start working? I agree it was probably what you think it is and changes in startup services and programs are actually done by editing the registry but we often have a GUI that will do it.

Once the machine seemed to return to normal after running "sfc/scannow", I happily left it alone. I figured whatever flaws the update had were pretty well fixed at the same time and that seems to have proven true.

[Para]

Para, to answer your question, group policy, to the best of my knowledge, doesn't apply to a machine but rather an authorized user. Employees of our hospital could roam to any workstation and log on with their user/pass and get all of their files and permissions from the server. They were then responsible to log out when they finished. However I have seen a workstation want to stay logged onto the domain controller server after leaving and be in the same position that the OP was. Something corrupted.

So it's all just curious and interesting is all.

Cheers

Absolutely correct. Its the profile (user account) that gets screwed up so when you log in and the OS tries to ensure all local GP's are up to date, fails and kicks you out. Problem is often your AD profiles becomes corrupt so stopping you roaming as every time you log in a new machine AD copies down your server profile and fails. You have to (in an AD environment) remove the profile from control panel, physically delete the c:\users\profile_name and also remove it from HKLM\profile list.

I wonder if in this case its simply the Group Policy Client service is not set to auto start?

We agree. I will say that it was hammered into me to never delete a profile but rather inactivate it. I don't know since I never did it but apparently there can be resources that belong to that owner that no one else can find. Again I don't know because that never happened due to inactivating instead.

Thanks, It's been a good discussion after I got my nose into the right direction.

Cheers.

You must remove the profile from profile manager as that breaks the bound user profile and the SID (security ID) simply deleting the c:\users\profile_name isnt enough as the SID is still bound. Thats why you also have to remove from profile manager and the profile name from HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList.

I hate corrupt profiles as creating a new one is as bad as installing all you apps and config again.

A system restore could work as long as you went back past the date of corruption.

[Para]

I'm glad to hear this. It's sure a lot easier to have it fix itself. Did you uninstall the updates and either leave it or reinstall them, or did it just start working? I agree it was probably what you think it is and changes in startup services and programs are actually done by editing the registry but we often have a GUI that will do it.

Once the machine seemed to return to normal after running "sfc/scannow", I happily left it alone. I figured whatever flaws the update had were pretty well fixed at the same time and that seems to have proven true.

As anyone with even the most basic knowledge of computers will tell you. If it ain't broke don't fix it!