NOVELL FORUMS - ZCM: Policies

Custom ADM policy not keeping changes

JCroberts — Wed, 18 Nov 2009 16:40:54 GMT

We use a program called beyond trust privilege manager. It elevates programs to administrator level while leaving the logged in account with limited user access to the computer. It requires a master computer that has the group policy extensions installed and a client on all of the workstations. I imported the adm into a new group policy. It shows up and can be configured but the settings don't stay past an upload. When I open the policy any changes I make are not shown. This worked perfectly in Zen 7. I even tried setting up the policy in Zen7 and importing it as an active directory policy. The settings still did not take for the workstations. I can't check to see if the settings got uploaded to the server because they are encrypted =/

Thanks for any suggestions anyone can give.

PS... ZCM Team: Please hire the Zen 7 guys to fix the way ZCM handles and stores group policies. Their way worked and was easy to manage. Yours doesn't work and is a pain in the *** to manage. This isn't an upgrade for sure.

"Path for the group policy content is null."

pmnade — Tue, 17 Nov 2009 16:43:14 GMT

Getting following error on server for many our workstations.
Anyone know how to correct this issue?
There was an error while accessing content for policy "Secondary Students". The error was - "Path for the group policy content is null."

Windows 7 group policy creation

Obiwan — Tue, 17 Nov 2009 16:07:44 GMT

Hello,

I'm still having trouble to create a group policy: Helper installed fine, after leaving the GP Editor I get a "ExportFailure"... no zip file present then.

Any ideas? (happens with W7 32 and 64 bit).

Ty in advance
Dirk

error during installation of the iPrint client on Windows XP

Bernhard Muehlbauer — Tue, 17 Nov 2009 14:35:15 GMT

Hi,

I wanted to create a printer policy but the printer
was not installed on a PC (later I figured out that I had
forgotten to install the iPrintClient previously).

Then tried to install the printer manually.

Started IE and loaded http:///ipp as URL
on the PC.
Clicked on the printer (to be installed) and I
received the message, that the "iPrint client was not installed".
I clicked "OK" for installation and then "execute" =>
"nipp.exe" => execute.

Now I received the following error message:
"iPrint client - the operating system is not supported
by this client" (sorry, but it was a german error message
and I had to translate it - and my translation is not very
good ;-) ).

If I perform the same scenario in Windows 2000 (ZfD 6.5) or
Windows XP (without! ZCM-Agent installed), everything is ok.

May be there is a bug in the installation of the iPrint Client
in conjunction with ZCM-Agent?

- version of iprint on OES2-SP1: 6.1.20090608-0.4.1
- versions of iprint on XP Professional: 5.12 and 5.30
with ZCM-Agent: 10.2.1

Thanks and regards

Bernhard

DLU Policy Conflict

zenking — Mon, 16 Nov 2009 21:10:21 GMT

I'm trying to set up DLU policies so that most new users are set as regular non-admin users, and then assign admin policy as necessary. Since workstations are already registered, I tried assigning the regular user dlu to all workstations, and then the admin dlu to specific users. The conflict is set to user last, which I thought would mean that the user policy would override the ws policy. I've read the doc:
Novell Documentation

but it doesn't work as I expected, and I'm not sure if the "User only" option would be my friend here. Any tips? Thanks.

Windows Group Policy = Error while ENFORCING the Policy

amaltsev1 — Thu, 12 Nov 2009 07:43:10 GMT

WORK-SERVER: W2003R2Term+NWclient+ZCM10.2.1 (without AD)

Steps:
1)
In the other TEST-SERVER W2003R2+AD create WGP (disable run
c:\Program File\Far\Far.exe
From this TEST-SERVER log in to the ZCM and create WGP: SRP_TEST
from this Policy from the AD
(*) Enable the enforcement of this policy
(*) Active Directory Group Policy
[ ] Computer configuration
[+] User configuration

This WGP for my user from eDIR: team2.
+Create Policy DLU for Team2 (not volatile)

2)
After this Log (localy only) as Administrator to WORK-SERVER.
zac cc
zac ref

3)
After this log to the WORK-SERVER as Novell-ZCM-user: Team2
Log - OK..
But user TEAM2 can Far.exe :(

At this time in the ZCM for the Policy SRP_TEST i see this error:
"There was an error while enforcing the policy "srp_test". Please refer the managed device log for details."

4)
After this reboot WORK-SERVER and AGAIN log in to the server (novell-zcm) as TEAM2 and:
4.1: User Can not run FAR.EXE - this is good , but...
4.2: In the ZCM i see this error again and in the ZCM-icon (under the term-wndows team2 session) | Show Properties | Policies i see error:
srp_test Failed

What can i do ?

Any body ave this error too ?

Serg

There was an error while enforcing the policy "srp_test". Please refer the managed device log for details.

DLU on 2k3 terminal server

dsmi87dgf — Tue, 10 Nov 2009 19:37:12 GMT

We are seeing an odd issue where a user will login with their edir credentials but they will get another user's local machine credentials. i looked in the user management mmc and sure enough Name was donaldd but Full Name was Daffy Duck
Can this be?
1.buggy DLU
2.maliciousness - one of our only servers hitable on a large protected and private network.
3.amateur admin (me)

Thank you for any ideas.
Dave

PS. This is one of our only machines in our ZCM 10. DLU does seem buggy on it. Sometimes we have to create a local user for a remote user manually.
Another buggy issue is that GPs are getting applied to us admins. I would then login with a local admin account to refresh the agent.

Multiple printer policies - refresh problem

Obiwan — Mon, 09 Nov 2009 14:10:43 GMT

Hi all,

I'm still having this problem with multiple printer policies:

If you add a printer policy and the order gets changed - the agent refresh starts to remove printers.

Simple example:

- have policy A and B assigned to a device
- remove policy A, add policy C, add policy A back
- refresh agent
- printers from policy A get removed -> you'll need either to reboot the workstation or do a "zac pl" which causes a "force logout because of changes"

I was able to workaround it by not changing the order (I always deleted all printer policy groups as they won't work pretty good for the same reason)), BUT now I found the problem again:

- we have a device folder (location), a default printer policy is assigned (policy A)
- a user asks for some additional printers (nearby black/white printer), so I add policy B to the device
- agent refreshed
- printers from policy A disappear until reboot

Same behaviour...by using folder and device assignment the policy order gets changed :|

Any solution?

Thx in advance
Dirk