On Mon, 21 Jul 2008 14:26:02 GMT, mdstewar wrote:

which version of ZCM are you running.

as a general rule:

- always configure an admin policy first which negates anything you do in
other policies
- always use a vm which you can role back
--

Marcus Breiden

If you are asked to email me information please remove the - in my e-mail
address.
The content of this mail is my private and personal opinion.
http://www.didas.de

On Tue, 22 Jul 2008 12:06:03 GMT, mdstewar wrote:

I guess nobody did put that into the documentation as it is a best practice
from MS.. or at least a best practice some people came up with.
--

Marcus Breiden

If you are asked to email me information please remove the - in my e-mail
address.
The content of this mail is my private and personal opinion.
http://www.didas.de

On Tue, 22 Jul 2008 15:46:02 GMT, mdstewar wrote:

lucky guy.. same priciple there:

the c1 snapin will make a copy of your local gpo
you start editing the local gpo
the c1 snapin will copy the edited local gpo to the server
the c1 snapin will copy the local gpo back

take a guess what happens when you have a problem at the 4th step.

BUT:

I guess I got sidetracked.. reading through it again it looks like you have
a problem with the Restrict Drives option. Is this correct?

If yes can you explain it a little bit more?
--

Marcus Breiden

If you are asked to email me information please remove the - in my e-mail
address.
The content of this mail is my private and personal opinion.
http://www.didas.de

In Marcus' defense, that best practice was mainly important if you were
using "Group Policies remain in effect after user logout/Persist
Workstation Settings". If you weren't, a reboot could unlock any
restrictions, but if you were even your techs would be subject to the
restrictions of the last logged in user.

mdstewar wrote: