List Archives

This forum is an archive of all posts to our mailing list over the past few years. The forum is set read only therefore to contribute you will need to join our list community. See more info about this here.

List Archives

Unanswered Active Topics

Forums Search

Forums >ActiveDir Mail List Archive >List Archives

Subject: RE: [ActiveDir] Security Filtering Computer Based Policies

Prev Next

You are not authorized to post a reply.

Author

Messages

dwells

Posts:39

09/08/2008 3:43 PM
Computers logon in a similar manner to users. As a result, they suffer from some of the same long-standing Windows limitations - that being, group membership modifications require that the access-token be refreshed; in user terms - that's a logoff/logon - in computer terms, that's a reboot . or sufficient patience for the kerb. ticket to fall outside of its renewability window and silently refresh in the background. -- Dean Wells * Email: limeypride@gmail.com From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of joe Sent: Wednesday, August 20, 2008 11:50 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Security Filtering Computer Based Policies So are you saying that after you reboot the machines after the group mods have replicated it isn't handling the group filtering right away? -- O'Reilly Active Directory Third Edition - http://www.joeware.net/win/ad3e.htm _____ From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of WATSON, BEN Sent: Wednesday, August 20, 2008 11:45 AM To: undisclosed-recipients: Subject: [ActiveDir] Security Filtering Computer Based Policies As part of a rollout for a specific policy we are applying to the company, we are pushing a policy that will be effected by security filtering at the outset. It works, and I can test it and when I check the GPResults I definitely see that the policy was denied by security. To perform the security filtering, I created a security group, added the computer accounts that I do NOT want to be affected by the policy, and then denied that security group the ability to apply the group policy. As I stated before, it works. but slowly. I was wondering if anyone else could explain why after making a change to the membership of the security group, it seems to take "some time" for the change to take effect as far as the security filtering is concerned. I know it's not a replication issue (if that even matters) as I push out the changes to the other DCs, yet it still takes awhile for the change in the security group to effect the security filtering applied against the GPO. Any thoughts? Thanks, ~Ben _______________________________________ Best way to <http://abcnews.go.com/print?id=5351908> annoy your co-workers? E-mail.

You are not authorized to post a reply.

Forums >ActiveDir Mail List Archive >List Archives > RE: [ActiveDir] Security Filtering Computer Based Policies

ActiveForums 3.7

Syndicate

Friends

List Archives

List Archives

Friends

Members

Articles

Related Links

Ads