none
Office 2010 user policy over trust not working

    Question

  • I have client machines in domain A, and User accounts from Domain B logging into those machines.

    Domain A trusts Domain B. (its a one way trust. Both domains run at 2008 R2 function level and clients are all windows 7)

    I have group policies in both domains. The machines get their GP settings from Domain A and that works fine. The user accounts get their settings from B. However, all of a sudden, I've having problems with Office 2010 policies. Client machines have office 2010, and Skype for Business 2013, so pick up policies for both versions of office.

    The office 2013 policies in Domain B for the users work fine. Office 2010 policies for users just aren't applying, and I cant figure out why.

    The policies aren't filtered, and are set for all authenticated users. I've tried enforcing the 2010 policy too.

    if I run a GP results, it shows both policies applying in the summary - but none of the office 2010 settings are being picked up.

    Other 'none office' related policies for the user accounts are running fine. Can anyone think of something i'm missing please?

    Thanks.

    Wednesday, March 23, 2016 2:42 PM

Answers

  • > If I have a user account in the same domain as the PC, and
    > apply matching policies on that domain for that user for office 2010 and
    > one for 2013, then I see results matching both office versions in the GP
    > results, and both sets the settings apply without issues.
     
    Ok, then I was wrong and it _should_ appear.
     
    > any ideas?
     
    Yes. Enable gpsvc debug logging and examine the gpsvc.log. It contains
    detailed information about all applied GPOs and in addition, it lists
    all registry values for all gpos that are applied with administrative
    templates.
     
    The values you are searching for can easily be looked up at
     
    Thursday, March 24, 2016 10:38 AM

All replies

  • Hi,

    Would you post the gpresult to us for further research?

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, March 24, 2016 6:34 AM
    Moderator
  • > if I run a GP results, it shows both policies applying in the summary -
    > but none of the office 2010 settings are being picked up.
     
    You are aware that Office stores its policy settings in different
    registry keys? Some of them contain the version number, some do not.
     
    Those that don't will show up in gpresult in the "first match" - in your
    case, Office 2013.
     
    Thursday, March 24, 2016 7:49 AM
  • Thanks Martin, I wasn't, however I'd still expect to see settings for both policies showing?

    When I run a GP results, I don't see any of the office 2010 settings listed under settings, policies, admin templates.

    If I have a user account in the same domain as the PC, and apply matching policies on that domain for that user for office 2010 and one for 2013, then I see results matching both office versions in the GP results, and both sets the settings apply without issues. 

    any ideas?

    many thanks.

    Thursday, March 24, 2016 9:49 AM
  • Hi,

    Would you post the gpresult to us for further research?

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Hi Jay,

    I'm not sure that I'd be allowed to post those, however in the summary of the GP results, there is a warning about a fast link being detected, although it doesn't give any more detail than that? There are also special alerts but those are just telling me that some of the GP's are enforced as far as I can tell.

    thanks.

    Thursday, March 24, 2016 10:02 AM
  • > If I have a user account in the same domain as the PC, and
    > apply matching policies on that domain for that user for office 2010 and
    > one for 2013, then I see results matching both office versions in the GP
    > results, and both sets the settings apply without issues.
     
    Ok, then I was wrong and it _should_ appear.
     
    > any ideas?
     
    Yes. Enable gpsvc debug logging and examine the gpsvc.log. It contains
    detailed information about all applied GPOs and in addition, it lists
    all registry values for all gpos that are applied with administrative
    templates.
     
    The values you are searching for can easily be looked up at
     
    Thursday, March 24, 2016 10:38 AM