I have two departments with frequent staff changes and want to cut down the setup needed at first login. A shared printer preference isn't appearing, and I also need a desktop shortcut and a trusted network location for an Access logbook.
The printer preference is under User Configuration, uses Update, and targets three computer names. The GPO is linked to the users' OU and has both Authenticated Users and the department group in security filtering. What should I check?
Start with gpresult for an affected user on one of those PCs. Check whether the GPO is applied or denied and whether the user account is actually in the scope of the linked OU. Resultant Set of Policy can help too.
If the GPO applies, look at the Group Policy Preferences event logs for the printer item. That helps separate a scope or filtering problem from a printer connection failure. A forced update alone won't tell you which part failed.
Authenticated Users in the security filter means the department group isn't restricting the GPO by itself. If the printer should follow department users to any domain PC, filter the user GPO to the department security group instead.
Keep computer account read access in mind when changing GPO permissions. Also, linking a user policy where the user accounts are in scope is different from linking it where the computers are.
b.619!inkwell:
That would change the behavior, though. The stated goal is a printer for anyone using those three PCs, not necessarily for department users on every PC.
A user preference can use computer-name item-level targeting. That's a reasonable fit for connecting the printer for users when they sign in on those particular machines. Check each targeting condition and its AND or OR relationship, since three different computer names joined with AND can't all match the same machine.
The user GPO still has to reach the signing-in user. If you want settings based on the computers' OU regardless of where user accounts live, loopback processing is another option, but check its merge or replace behavior before enabling it.
For the logbook, use a Group Policy Preferences shortcut item pointing to the file on the share. The Office administrative templates also provide user policies for trusted locations, including allowing trusted locations on the network.
Be careful with the trusted path. Keep it as narrow as practical and limit who can write to that location, since files there are being trusted. Test the shortcut and the Access policy with a new user before rolling them out more widely.
If you switch to targeting a computer security group, remember that a newly added computer may need a restart before its group membership is reflected in its security token. That's separate from the current computer-name targeting, which doesn't require that group.
Answers are reviewed before publication.
r52+gearshift_816:
Thanks, I'll check the results on one of the department PCs first.