When you’re in a Windows 2003 network with Windows XP clients, Internet Explorer settings defined in your Group Policy may not be applied. Misconfiguration is often the cause of your Internet Explorer settings not being applied to your Windows XP clients.
In this article i will sum up the reasons why your Internet Explorer settings are not applied. I assume you’re running Windows 2003 SP2 on your domain controller (although SP0 or SP1 should be no problem), Windows XP SP2 on your clients, and Internet Explorer 6 (at least Internet Explorer 6 SP1). I also assume you do NOT use the Internet Explorer Maintenance Mode. If you do, my advice would be to stop using it. Setting every option in the Group Policy separately gives you much more control.
So, here are the issues you may struggle with
1) The Internet Explorer policy is not applied (while other policies are):
An often made mistake is forgetting to link your Group Policy to the OU. For testing purpose, best is to put both the user and the computer in a test OU. In this situation you can be sure all policies are being applied.
To make sure the policy is being applied, you can logon to the computer, open a Command Prompt and type gpresult. This will list all policies that are applied in the current session.
2) Small changes are not updated:
Small changes (like setting a feature from Enabled to Prompt) might not be recognised as a change. Even when you do a gpupdate /force (forcing the computer to be updated with all assigned policies), the setting will not be set back to the old value. In your Group Policy, go to
Computer Configuration (Enabled) -> Administrative Templates -> System/Group Policy
and set the following options:
- Internet Explorer Maintenance policy processing: Enabled
- Process even if the Group Policy objects have not changed: Enabled
3) Only the User Configuration / Computer Confiuration is being applied:
When you have set all your preferences in the User Configuration, and you have excluded the user Configration from applying, this might make sense 🙂 To verify you did not set any configuration disabled, open your Group Policy, right click on the root item and choose Properties. Verify none of the two checkboxes is checked.
4) None of all policies is being applied:
This can be a result of a dozen of reasons. You may have trouble with your DNS. I would suggest you first try to fix this problem, before you start to worry about the Internet Explorer policies. DNS should be one of your highest priorities in an Active Directory domain
Another interesting issue: You might notice that your Security Zones in Internet Explorer are not changed. For example: when you set your Internet zone security to High in the Group Policy, this setting will not be changed on the client! You might think that the setting is not being applied, but it IS! All the settings, attached to the security level “High“, are applied. Verify it yourself by setting all Internet Explorer options on your client to disabled, Then, reboot your computer, logon again and see most options are set back to the preferred setting.
Any suggestions, questions or additional notes, both grammar and technical 😉 ? Feel free to comment!
