none
How to remove a "ghost" group policy preference? RRS feed

  • Question

  • I have a group policy that when I was testing I added in a preference to set Internet Explorer 9 Home Pages. Before going live, this preference was removed from the policy as it didn't have the desired result at the time.

    When I look at the deployed policy there is no trace of the preference.

    I am now trying to configure a new preference policy to reset everyone's home pages to a specific set depending on which department they are working in.

    When I try to deploy the preference to my test PC and User nothing happens. When I look at Group Policy results it looks like the home pages are still being controlled by this old preference even though it no longer exists.

    How do I clear this "ghost" setting that is hanging around?

    I have tried resetting Internet Explorer and this has no effect.

    Thanks in advance for any advice given.


    Darren

    Tuesday, September 4, 2012 3:44 PM

Answers

  • Hi,

    That’s odd issue. You may refer to below procedure to trace down the issue.

    In the GPO “Internet Explorer 8 Security Settings”, reconfigure IE preference item with a test URL.

    On client computer, run “gpupdate /force” to refresh group policy, check whether new GPP settings apply to user?

    Remove IE preference item settings in GPO “Internet Explorer 8 Security Settings”, on client computer, rerun ““gpupdate /force” and use GPMC to generate a Group Policy result and Check whether old preference item remain exist.

    At GPO Details tab, get the GPO’s GUID. Check Preference .xml file in path “\\domain\SYSVOL\domain.com\policies\GUID\User\Preference\InternetSettings\InternetSettigns.xml”

    Check whether the .xml file contain old preference settings?

    Check GPO “GG Crewing Internet Explorer”, check whether the IE home page settings is display with green line?

    Check registry key on client computer “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page”

    Change its value to “about:blank”, refresh group policy and check the result.

    Give us feedback for further troubleshooting.

    Hope this helps!

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.


    Lawrence

    TechNet Community Support

    Thursday, September 6, 2012 6:45 AM
    Moderator
  • Hi,

    > I have reset the home pages manually but new preferences do not get applied.

    The screen capture shows your new IE GPO “GG Crewing Internet Explorer” settings with red line, which mean this preference is not enabled.

    A setting with a dashed red underline or red circle with a slash is disabled. The preference extension does not apply this setting's value to the user or computer.

    You can enable or disable these settings within a preference item by pressing function keys:

    F5

    Enable all settings on the current tab.

    F6

    Enable the currently selected setting.

    F7

    Disable the currently selected setting.

    F8

    Disable all settings on the current tab.

    So on “GG Crewing Internet Explorer” settings page, press F6 to enable IE Home Page settings. On client computer, run “gpupdate /force” and check the result.

    For more information please refer to following MS articles:

    Enable and Disable Settings in a Preference Item
    http://technet.microsoft.com/en-us/library/cc754299.aspx
    Red / Green Underlining continued: Using Preferences to set IE settings like preference, or like policy
    http://blogs.technet.com/b/grouppolicy/archive/2008/10/20/red-green-underlining-continued-using-preferences-to-set-ie-settings-like-preference-or-like-policy.aspx

    Hope this helps!

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.


    Lawrence

    TechNet Community Support

    Tuesday, September 11, 2012 5:41 AM
    Moderator
  • Hi,

    > however the new preference setting does not appear in the settings even though it says the GPO was
    > applied.

    How you know the GPO was applied? Gpresult from “gpresult” command” or Group Policy result from GPMC (Group Policy Management Console)?

    Group Policy Preference result can only be checked at settings tab of the Group Policy result.

    Check that, make sure IE preference settings is applied to the different PC.

    If IE preference is applied, it will overwrite old preference settings.

    > I ran gpupdate /force checked Internet Explorer and it made no change to the home page (still at
    > about:blank from when I reset it).

    If IE shows Home page “about:blank”, I think that means old preference not reapply. That’s good news, we now should troubleshoot new preference GPO.

    Deploy a new GPO with IE preference settings and link it to an OU which contain user account objects, do no set WMI filtering or security filtering. Check whether the new GPO apply to user.

    Test that and give us feedback for further troubleshooting.

    Hope this helps!

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.


    Lawrence

    TechNet Community Support

    Wednesday, September 12, 2012 5:41 AM
    Moderator
  • Hi Lawrence,

    Finally resolved the issue today! The solution was in 2 parts:

    Part 1

    Deleted my user profile and started with a fresh one. This seemed to remove the "Ghost" policy setting but it did not allow for the new preference policy to be picked up.

    Part 2

    Getting the new policy to apply required this hotfix (http://support.microsoft.com/kb/2530309) "Internet Explorer Group Policy Preferences do not apply to Internet Explorer 9 in a Windows Server 2008 R2 domain environment"

    Once I applied the new hotfix all was sorted.

    Would have been nice to do it without blowing away all my other user configurations but I guess a spring clean every now and then to clean up a large profile isn't so bad.

    Thanks for all your input on this.


    Darren

    • Marked as answer by Darren Thorley Wednesday, September 26, 2012 1:24 PM
    Wednesday, September 26, 2012 1:23 PM

All replies

  • Hi,

    > this preference was removed from the policy as it didn't have the desired result at the time.

    The preference setting was removed from GPO or the GPO link was removed from OU?

    > When I look at Group Policy results

    How you look Group Policy results, check IE settings directly or “gpresult” command?

    > it looks like the home pages are still being controlled by this old preference even though it no longer
    > exists.

    Do you mean the Preference GPO is still applied in gpresult?

    Group Policy Preference has feature “tattoo”, in other words, when a GPO goes out of scope, the preference value will remain in the registry.

    To check whether the new preference settings applied, please use Group Policy Management Console to generate a Group Policy result, then you can check it at Settings tab.

    Please post error message is exist.

    Give us feedback for further troubleshooting. For more information please refer to following MS articles:

    GP Policy vs. Preference vs. GP preferences
    http://blogs.technet.com/b/grouppolicy/archive/2008/03/04/gp-policy-vs-preference-vs-gp-preferences.aspx
    Red / Green Underlining continued: Using Preferences to set IE settings like preference, or like policy
    http://blogs.technet.com/b/grouppolicy/archive/2008/10/20/red-green-underlining-continued-using-preferences-to-set-ie-settings-like-preference-or-like-policy.aspx

    Hope this helps!

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.

     


    Lawrence

    TechNet Community Support

    Wednesday, September 5, 2012 3:11 AM
    Moderator
  • The setting was removed from the original GPO before being linked to the production OU.

    I am looking at the results both via I.E. on one of the sample PCs we use for testing and then using the GPResults from the Group Policy Management MMC from the 2008 R2 Remote Server Tools

    I do mean that the Preference GPO is still being applied in the output from GPResult as well as on the actual PC I am testing with.

    I know that Preferences have a Tattoo feature but I was trying to create a new Preference which I would have hoped would "tattoo" over the top of the old preference (or at the very least merge). When this did not happen I started to investigate further using the Group Policy Management MMC I was very surprised to see that the reason the PC was not picking up the new preference was because the old preference was still "winning" despite the old GPO without the preference in it being lower down in the order to apply. I have tried jiggling around the orders with no effect.

    This "ghost" preference stubbornly refuses to go both on the actual PC and in GPResult.

    Any ideas how I clear it out?


    Darren

    Wednesday, September 5, 2012 5:53 AM
  • Hi,

    > The setting was removed from the original GPO before being linked to the production OU.

    So do you mean the old GPO is still linked to OU with other policy settings?

    > I was very surprised to see that the reason the PC was not picking up the new preference was because the
    > old preference was still "winning" despite the old GPO without the preference in it being lower down in
    > the order to apply.

    You create a new GPO with IE preference settings, and the new GPO is also applied, but its settings not take effect on client?

    What do you mean “being lower down in the order”, could you please give us a screen capture, which may help us understand your issue.

    We can modify preference value after apply GPP, modify the IE home page in your client computer to use blank page; after that run “gpupdate /force” to force refresh policy to check whether is still apply old preference value.

    If possible please give us some screen capture of your issue and Group Policy result to help us troubleshoot this issue.

    Hope this helps!

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.


    Lawrence

    TechNet Community Support

    Wednesday, September 5, 2012 7:06 AM
    Moderator
  • Yes. The old GPO is still there but with different settings (it is called Internet Explorer 8 Security Settings). There is no trace of the old preference as you can see in this screen shot from the Group Policy Management MMC

    Here is a screenshot of what I mean by lower down in the order. The new policy is called GG Crewing Internet Explorer. I have tried moving them around and swapping them around to see if that makes a difference. It doesn't.

    I have also tried resetting I.E. on the test PC and the home pages don't get reset, nor do they pick up the new settings. I think this is because the old preference setting that no longer exists was set to apply once. Can't be sure as I have nothing to go back and look at to check.

    I have tried gpupdate /force and it makes no difference.


    Darren

    Wednesday, September 5, 2012 7:42 AM
  • Here are the screenshots from the results

    And here is how they get applied

    Am I missing something obvious or is something very odd happening?


    Darren

    Wednesday, September 5, 2012 7:44 AM
  • Hi,

    That’s odd issue. You may refer to below procedure to trace down the issue.

    In the GPO “Internet Explorer 8 Security Settings”, reconfigure IE preference item with a test URL.

    On client computer, run “gpupdate /force” to refresh group policy, check whether new GPP settings apply to user?

    Remove IE preference item settings in GPO “Internet Explorer 8 Security Settings”, on client computer, rerun ““gpupdate /force” and use GPMC to generate a Group Policy result and Check whether old preference item remain exist.

    At GPO Details tab, get the GPO’s GUID. Check Preference .xml file in path “\\domain\SYSVOL\domain.com\policies\GUID\User\Preference\InternetSettings\InternetSettigns.xml”

    Check whether the .xml file contain old preference settings?

    Check GPO “GG Crewing Internet Explorer”, check whether the IE home page settings is display with green line?

    Check registry key on client computer “HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page”

    Change its value to “about:blank”, refresh group policy and check the result.

    Give us feedback for further troubleshooting.

    Hope this helps!

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.


    Lawrence

    TechNet Community Support

    Thursday, September 6, 2012 6:45 AM
    Moderator
  • Hi,

    I would like to confirm what is the current situation? Have you resolved the problem?

    If there is anything that we can do for you, please do not hesitate to let us know, and we will be happy to help.


    Lawrence

    TechNet Community Support

    Monday, September 10, 2012 2:06 AM
    Moderator
  • Hi,

    Sorry for the delay in getting back to you.

    The issue is still there.

    As I mentioned originally, the preference was removed ages ago this is why I don't understand why the setting seems to be winning against new settings as it should no longer exist.

    I ran gpupdate /force but this made no difference.

    I checked the folder you suggested but there is no xml file in there.

    I have reset the home pages manually but new preferences do not get applied.

    The GPO "GG Crewing Internet Explorer”, check whether the IE home page settings is displaying with a red line

    I changed the registry setting to about:blank but it made no difference.

    I have even removed the link to the old GPO "Internet Explorer 8 Security Settings", created a new GPO with settings that I want (in other words no prefence setting to set the home page) and given it a different name.

    When I do a gpupdate /force and check the result it makes no difference. When I view the results in the GPMMC > Group Policy Results the setting is still shown as a winning GPO but now it shows the GUID for the GPO "Internet Explorer 8 Security Settings" instead of the name.

    I'm completely stumped.

    Thanks for your interest, any suggestions are greatly appreciated.


    Darren

    Monday, September 10, 2012 6:26 AM
  • Hi,

    > I have reset the home pages manually but new preferences do not get applied.

    The screen capture shows your new IE GPO “GG Crewing Internet Explorer” settings with red line, which mean this preference is not enabled.

    A setting with a dashed red underline or red circle with a slash is disabled. The preference extension does not apply this setting's value to the user or computer.

    You can enable or disable these settings within a preference item by pressing function keys:

    F5

    Enable all settings on the current tab.

    F6

    Enable the currently selected setting.

    F7

    Disable the currently selected setting.

    F8

    Disable all settings on the current tab.

    So on “GG Crewing Internet Explorer” settings page, press F6 to enable IE Home Page settings. On client computer, run “gpupdate /force” and check the result.

    For more information please refer to following MS articles:

    Enable and Disable Settings in a Preference Item
    http://technet.microsoft.com/en-us/library/cc754299.aspx
    Red / Green Underlining continued: Using Preferences to set IE settings like preference, or like policy
    http://blogs.technet.com/b/grouppolicy/archive/2008/10/20/red-green-underlining-continued-using-preferences-to-set-ie-settings-like-preference-or-like-policy.aspx

    Hope this helps!

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.


    Lawrence

    TechNet Community Support

    Tuesday, September 11, 2012 5:41 AM
    Moderator
  • Still no joy I'm afraid. The setting is now enabled (green line present). I ran gpupdate /force checked Internet Explorer and it made no change to the home page (still at about:blank from when I reset it). I then checked the results in the GP MMC and the ghost policy preference is still winning.

    Firstly, is there a way of clearing this ghost preference. It must be coming from somewhere. I did a search of the registry for one of the values and it found nothing so it must be somewhere else. It would be good to know where this information is being "cached". As mentioned previously there is no trace of an xml file in the SYSVOL folder so it can't be there either.

    Secondly, I went to a different PC and logged in as my test user. The ghost setting is not present on this different PC - HOORAY! However the new preference setting does not appear in the settings even though it says the GPO was applied.

    Sorry about this - I seem to be struggling with preferences. GPO settings work no problem but preferences seem to be problematic and I'd like to figure out why.

    We use WMI filters and security filtering to target settings - the WMI filter is used to make sure it only applies to PC running Windows 7 using the following:

    select * from Win32_OperatingSystem where Version like "6.1%" and ProductType = "1" on the root\CIMv2 namespace.

    It is applied to a security group of which my test user is a member.

    This is our standard approach and would have been how the ghost preference would have been configured as well so I don't think it is relevant but just in case...

    Thanks for your assistance with this weird little problem.


    Darren

    Tuesday, September 11, 2012 7:48 AM
  • Hi,

    > however the new preference setting does not appear in the settings even though it says the GPO was
    > applied.

    How you know the GPO was applied? Gpresult from “gpresult” command” or Group Policy result from GPMC (Group Policy Management Console)?

    Group Policy Preference result can only be checked at settings tab of the Group Policy result.

    Check that, make sure IE preference settings is applied to the different PC.

    If IE preference is applied, it will overwrite old preference settings.

    > I ran gpupdate /force checked Internet Explorer and it made no change to the home page (still at
    > about:blank from when I reset it).

    If IE shows Home page “about:blank”, I think that means old preference not reapply. That’s good news, we now should troubleshoot new preference GPO.

    Deploy a new GPO with IE preference settings and link it to an OU which contain user account objects, do no set WMI filtering or security filtering. Check whether the new GPO apply to user.

    Test that and give us feedback for further troubleshooting.

    Hope this helps!

    TechNet Subscriber Support

    If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.


    Lawrence

    TechNet Community Support

    Wednesday, September 12, 2012 5:41 AM
    Moderator
  • Hi,

    I would like to confirm what is the current situation? Have you resolved the problem?

    If there is anything that we can do for you, please do not hesitate to let us know, and we will be happy to help.


    Lawrence

    TechNet Community Support

    Friday, September 14, 2012 9:22 AM
    Moderator
  • Hi,

    As this thread has been quiet for a while, we assume that the issue has been resolved. At this time, we will mark it as 'Answered' as the previous steps should be helpful for many similar scenarios.

    If the issue still persists and you want to return to this question, please reply this post directly so we will be notified to follow it up. You can also choose to unmark the answer as you wish.

    In addition, we'd love to hear your feedback about the solution. By sharing your experience you can help other community members facing similar problems.

    Thanks!


    Lawrence

    TechNet Community Support

    Wednesday, September 19, 2012 7:06 AM
    Moderator
  • Hi Lawrence,

    Finally resolved the issue today! The solution was in 2 parts:

    Part 1

    Deleted my user profile and started with a fresh one. This seemed to remove the "Ghost" policy setting but it did not allow for the new preference policy to be picked up.

    Part 2

    Getting the new policy to apply required this hotfix (http://support.microsoft.com/kb/2530309) "Internet Explorer Group Policy Preferences do not apply to Internet Explorer 9 in a Windows Server 2008 R2 domain environment"

    Once I applied the new hotfix all was sorted.

    Would have been nice to do it without blowing away all my other user configurations but I guess a spring clean every now and then to clean up a large profile isn't so bad.

    Thanks for all your input on this.


    Darren

    • Marked as answer by Darren Thorley Wednesday, September 26, 2012 1:24 PM
    Wednesday, September 26, 2012 1:23 PM