Return to Answer

• http://serverfault.com/questions/how-to-ask
• http://msmvps.com/blogs/jon_skeet/archive/2010/08/29/writing-the-perfect-question.aspx
• How to ask a smart question
• http://support.microsoft.com/kb/555375
• http://catb.org/esr/faqs/smart-questions.html

I am reading your question about group policies. You title is vague, your first paragraph doesn't tell me what the problem is. You vaguely mention two group policies which may be conflicting, but your question would probably be far more readable if you assigned names to them for the question. It would have helped if you described your OU structure, or at least an OU structure exactly like the domain you are having problems on.

As an example, I would re-write your group policy question like this:

• https://serverfault.com/questions/how-to-ask
• http://msmvps.com/blogs/jon_skeet/archive/2010/08/29/writing-the-perfect-question.aspx
• How to ask a smart question
• http://support.microsoft.com/kb/555375
• http://catb.org/esr/faqs/smart-questions.html

I am reading your question about group policies. You title is vague, your first paragraph doesn't tell me what the problem is. You vaguely mention two group policies which may be conflicting, but your question would probably be far more readable if you assigned names to them for the question. It would have helped if you described your OU structure, or at least an OU structure exactly like the domain you are having problems on.

As an example, I would re-write your group policy question like this:

• http://serverfault.com/questions/how-to-ask
• http://msmvps.com/blogs/jon_skeet/archive/2010/08/29/writing-the-perfect-question.aspx
• How to ask a smart question
• http://support.microsoft.com/kb/555375
• http://catb.org/esr/faqs/smart-questions.html

• http://serverfault.com/questions/how-to-ask
• http://msmvps.com/blogs/jon_skeet/archive/2010/08/29/writing-the-perfect-question.aspx
• How to ask a smart question
• http://support.microsoft.com/kb/555375
• http://catb.org/esr/faqs/smart-questions.html

• http://www.useit.com/alertbox/9710a.html
• http://en.wikipedia.org/wiki/Inverted_pyramid
• http://www.useit.com/papers/webwriting/
• http://www.e-gineer.com/v1/articles/web-writing-for-many-interest-levels.htm
• http://www.useit.com/alertbox/percent-text-read.html
• http://www.webinmind.net/2006/09/17/emphasize-key-words-make-your-text-scannable/

• http://serverfault.com/questions/how-to-ask
• http://msmvps.com/blogs/jon_skeet/archive/2010/08/29/writing-the-perfect-question.aspx
• How to ask a smart question
• http://support.microsoft.com/kb/555375
• http://catb.org/esr/faqs/smart-questions.html

 

I have two policies which are supposed to modify the setting, and the  they do not seem to be proccessed the way I believe they should.

 

The two policies control the the visibility of the administrative  tools on the start menu setting.

 

 

• Show_Admin_Tools

  • Applies to Domain Admins, and nothing else
  • Linked at the root only
  • Link order position = 1
 

• Hide_Admin_Tools

  • Applies to Authenticated Users
  • Linked at the root only
  • Link order position = 2
 

 

There is no loopback processing, policies are not enforced, and  inheritence is not blocked.

 

When gpupdate is run as an administror... the Administrative Tools  link does not show on the Start Menu. If it is manually turned on,  it is removed again at GP refresh. Checking Group Policy results on a  machine shows shows three GPO applications, in the following  sequence: first the Authenticated Users GPO, then the Domain Admins  GPO, then the Authenticated Users GPO again.

 

!! might put a picture here of the picture here of the gpresults  output, or the eventlog messages !!

 

Can anyone explain why the Authenticated Users GPO would apply last,  even though it has already been applied and the link order seems to  suggest that the show tools policie should take precedence? How do I  use group policies to display the admin tools for admins, and hide  them for everyone else?

• http://www.useit.com/alertbox/9710a.html
• http://en.wikipedia.org/wiki/Inverted_pyramid
• http://www.useit.com/papers/webwriting/
• http://www.e-gineer.com/v1/articles/web-writing-for-many-interest-levels.htm
• http://www.useit.com/alertbox/percent-text-read.html
• http://www.webinmind.net/2006/09/17/emphasize-key-words-make-your-text-scannable/

• http://serverfault.com/questions/how-to-ask
• http://msmvps.com/blogs/jon_skeet/archive/2010/08/29/writing-the-perfect-question.aspx
• How to ask a smart question
• http://support.microsoft.com/kb/555375
• http://catb.org/esr/faqs/smart-questions.html

 

I have two policies which are supposed to modify the setting, and the  they do not seem to be proccessed the way I believe they should.

 

The two policies control the the visibility of the administrative  tools on the start menu setting.

 

 

• Show_Admin_Tools

   

• Applies to Domain Admins, and nothing else

• Linked at the root only

• Link order position = 1

• Hide_Admin_Tools

   

• Applies to Authenticated Users

• Linked at the root only

• Link order position = 2

 

There is no loopback processing, policies are not enforced, and  inheritence is not blocked.

 

When gpupdate is run as an administror... the Administrative Tools  link does not show on the Start Menu. If it is manually turned on,  it is removed again at GP refresh. Checking Group Policy results on a  machine shows shows three GPO applications, in the following  sequence: first the Authenticated Users GPO, then the Domain Admins  GPO, then the Authenticated Users GPO again.

 

!! might put a picture here of the picture here of the gpresults  output, or the eventlog messages !!

 

Can anyone explain why the Authenticated Users GPO would apply last,  even though it has already been applied and the link order seems to  suggest that the show tools policie should take precedence? How do I  use group policies to display the admin tools for admins, and hide  them for everyone else?