Princess Fix IT

I consider Group Policy to be one of the more accessible administration tools to date. It is quite useful and fairly easy to maneuver, but that didn?t come into play with my latest GP task.

With the recent expiration of the SP2 download block from Windows Update, it is necessary to know the effects SP2 could have on your user environment. Obviously each user environment differs, but most users will be affected by the default option of turning the Windows Firewall to the On position upon installation of Service Pack 2 for Windows XP. When you have a decent amount of users this will push down to, the best option is to block the Firewall with Group Policy. It is an easy block to administer, but for some reason, still unknown to me, it would not push in my test environment. I would continually receive an Inaccessible error as the Reason Denied when running the Group Policy Results Wizard on the test machines. I checked permissions, recreated the Policy and did an amazing amount of research on the topic. Maybe because SP2 is a fairly new package to distribute Group Policies on, it hindered my search results. All the same, after a week of struggling with Inaccessible errors and pounding my head against my monitor, I found a workaround. I say workaround because I do not know the reason behind the fix so it can?t very well be called a solution. Sometimes a workaround is good enough and you won?t always be able to explain why they work. I?ve found in my line of work, it is perfectly acceptable to say ?It works. I don?t know why it didn?t work to begin with, or why it works now.? As long as you have a user working, that is all that matters in the end.

I created a standalone Policy which means I didn?t tie it to an existing GP. I checked and rechecked the permissions on each Policy User and even the Policy folders on the Domain Controllers. I updated the ADM files to the XPSP2 release and created the Policy on multiple machines. When creating a GP for Windows XP SP2, you must create it from a computer with that exact OS, so I did that as well. None of these produced successful results. A SP2 Windows Update block is also in place so I checked that Policy to see if it was interfering with the push down of my Firewall block. This is the best explanation I could come up with. I?m not sure if the Windows Update GP was the cause, but after attaching the Firewall Block to the existing Windows Update block GP and adding the latest system ADM file, all was working as it should. Hmmmm?well I couldn?t complain as everything was working properly, but I still wonder?why wasn?t it working as a standalone GP?

I guess I may never know?but as I said before, sometimes a workaround is all you have.