Hey guys, hopefully someone can assist on this question.

I have xp pro (laptop) and 2003 server enterprise on desktop. I am trying to run a lab at home with 3 computers and 1 domain. I can successfully create accounts on the domain, and the users can log in via their pcs...etc. I was able to activate remote desktop on both the DC side and the user side...

I created a Customer Service Group in AD, created an Organization in AD with its own group policy...the problem is. Anything I change in that policy, is not reflected on the users that are in that group. IE. Remove system clock, disable changing of desktop background, i also tried to give them access to network properties...but it still wont allow or disallow those things i enabled or disabled. I ran gpupdate on both the server and client side, but I must be doing something wrong here.

I know you need to make users and ADMIN on their own machine by logging into the computer, and making them a local administrator. But if i wanted to remove the clock on the taskbar when they log into the domain...i should have been able to do it through the group i created, and the group policy i editted. (i created a new one) i rebooted both the pc and laptop, still nothing.

ANyideas?

are the users and computers under the OU that has the group policy?

Users do not have to be admins if their own boxes and in fact that is not a good thing.

Give a person a fish you feed them for a day.
Ask a person to internet search and they learn a skill for a lifetime.

actually, just the user is.

I added the user to the group of Customer Service - added it to the organization of Customer Service Org. But only added the users there, not the computers...

Should I have added the computers as well?

I only added the USER to the group that was attached to the OU.

I just added the computer now, ran GPUPDATE...still showing the clock on system tray, so i know it didnt work. I'll try rebooting now.

maybe this will help
http://www.microsoft.com/technet/prodtechnol/windows2000serv/howto/grpolwt.mspx

Give a person a fish, they eat for a day. Suggest they internet search and they learn a skill for a lifetime.

run gpresult on the workstation to see what policies are being applied, when policies are being applied, if one fails to apply none of the ones that should apply after that wont take effect

wanderer, the computer shouldnt be in the OU that the users are in. workstations should have there own OU and policies, putting a GPO on a workstation will take effect for every user that logs into that workstation

if you have workstations in an OU, and users in another OU. If you have conflicting policies, which one takes precendence? Always computer policy over user?

computer settings usually but it depends on the policy, what i do when i make GPOs is put all the settings for workstations, in a policy of their own, and seperate policies for my different users OUs, u can also link multiple GPOs to a single OU so multiple settings dont have to be set more than once

it helps to make the least restrictive policies first, then link them as necessary, after that make another policy thats a little less restrictive than that, this way u can link all the GPOs to OUs u want to be very restricted and dont have to make a seperate GPO with all the other settings that u set in all the other GPOs, this saves a lot of time

thanks so much for that...but the problem is...when i'm administering the technical support group policy in the OU of technical support. I created a whole new group policy...but its only when I log into the server locally, its not when I log into the domain.

For example. I enabled "disable clock in system tray". So now when I log in as any user in the tech support group (10 users). The clock in the system tray is gone on the server, but when they log in on the laptops...the clock is still there.

What i'm trying to do it allow/disallow certain things for users in the domain, but everything I change only effects users logging onto the local domain contoller.

It's almost like when I log into the laptop, its not reading from the domain policy at all . I do a gpupdate, then gpresult, and the gpresult is nothing. Says there is no policy to read or access...etc..not sure exactly what it says, but you get the drift.

I cant seem to get the policies to work in the users that are logging into the domain from OTHER computers...

try linking the policy to the computers OU instead of linking it to a users OU

see here for troubleshooting group policy

http://technet2.microsoft.com/WindowsServer/en/Library/dfe7b84d-8727-4561-9767-ccb47a5bf9ba1033.mspx