xenapp and GPO

anything I don't mind · 9 May 2011 at 14:56

We have a xenapp 6 on 2008 r2 and we have our profiles setup on another server and the domain group policy is set up so that the citrix users accounts have a locked down profile.

Well we had to move all the profiles to another server and we updated the start up scripts and the GPO with the new server details. This broke some of the gpo redirects, namely the my documents redirect. It would just hang and not connect.

When creating a new profile for the user that resolves the problem.

But during my messing around with GPO I was trying to fix another issue we had with home drive not showing up for the users.

I have made a change to GPO and have since disabled that change but it still appears to be active. Even when logging in with admin accounts it still seems to use this GPO even though it was not configured for admin accounts. I have done a gpupdate /force on all the DC and the citrix server and i have left it for one hour and still new accounts when logging in, they are still not using the correct group policy.

Why is group policy so ineffective. surely I should be able to just make changes as i want to the group policy then run the gpupdate command and it should all work. I have had such problems with the GPO just not updating and now it refuses to update at all.

any ideas ?

paradigm · 9 May 2011 at 15:05

Folder redirection fails when the containers for the redirected folders have permissions other than those explicitly created when the profile was created.

My guess, with the move, you've now got additional permissions on the users folders, such as Admin permissions.

anything I don't mind · 9 May 2011 at 15:09

Comparing the permissions on an original profile folder (one that has been copied) to one that has just been created after renaming that one, are exactly the same.

Have you experienced problems with group policy where certain aspects of the policy refuse to apply ?

For example the policy it states remove all control panel icons apart from a few, this does not work. however some of the other policies work, like disabling cmd.

group policy seems some what ineffective and inconsistent.

anything I don't mind · 9 May 2011 at 17:38

never mind it was my fault, being stupid.

working now, sorry to bother.

edit: in case you were wondering what was wrong, I was using domain admins with the citrix user accounts as a test, i copied my account, stupid. So this was causing inconsistent results with the citrix user account.

But we still have this issue with the profiles so will probably have to create new profiles for all users :/