  Troubleshooting Internet Explorer and Group Policy Issues    To allow trusted sites full access to Internet Explorer functions, recongure the Security zone settings as follows.   Click the Internet Explorer icon on the taskbar. The Internet Explorer window appears.   Click Tools | Internet Options. The Internet Options dialog box appears.   Click the Security tab.   Select the Local intranet icon.   Adjust the Security level slider to Medium.   Select the Trusted sites icon.   Adjust the Security level slider to Low.   Click OK.  ■ The process of troubleshooting Internet Explorer problems is fundamentally the same as that for any IT problem. The procedure can be broken down into the following basic steps: identify the symptoms, determine the scope of the problem, isolate the location of the problem, list possible causes, apply a solution, and test the results. ■ Depending on how the IT department of your organization is organized, the role of the Windows 7 desktop administrator in the troubleshooting process might vary. In smaller organizations, you might be responsible for elding end-user problems and following them wherever they lead. However, in larger organizations, you might nd yourself some- where in the middle of a technical support hierarchy. ■ Try accessing the Web site from other network segments or subnets. You are attempt- ing to discover whether there is an infrastructure issue affecting part, but not all, of the network. ■ A problem with a Dynamic Host Conguration Protocol (DHCP) server can prevent just the computers on a specic subnet from obtaining the IP addresses they need to access the Internet. When a computer running Windows fails to locate a DHCP server, or if the server is unable to supply it with an address, Windows automatically assigns itself an address, using a technique called Automatic Private IP Addressing (APIPA). ■ If a computer cannot access the http://www.adatum.com site, but it can access http://207.46.232.182, DNS is almost certainly the problem. Lesson 1: Troubleshooting Internet Explorer Issues   ■ Firewalls block network trafc by design, and an improperly congured rewall could prevent users from accessing Internet Web sites. ■ Internet Explorer includes a feature called Compatibility View, which enables the browser to emulate older development standards.  You can use the following questions to test your knowledge of the information in Lesson 1, “Troubleshooting Internet Explorer Issues.” The questions are also available on the companion CD if you prefer to review them in electronic form. Note      What kind of problem is indicated when Internet Explorer fails to access any sites on the Internet and the computer has an IP address on the 169.254.0.0/16 network?   A DNS failure   A DHCP failure   A Windows Firewall conguration error   A missing certicate   Which of the following is not a possible cause of a problem that enables Internet Explorer to access standard Web sites using port 80 but not Web sites protected with SSL?   A Windows Firewall conguration problem   A DNS failure   A missing certicate   A security zone problem   Which of the following methods should you use to test whether a DNS problem is preventing access to an Internet Web site?   Modify the security zone settings for the Internet zone.   Connect to the site using an https:// prex.   Check to see if the computer is using a 169.254.0.0/16 address for the DNS server.   Use an IP address in the URL rather than a server name.   Troubleshooting Internet Explorer and Group Policy Issues  Group Policy is an essential tool for Windows administrators at all levels. For desktop admin- istrators, Group Policy eliminates the need to manually congure dozens, if not hundreds, of individual Windows 7 settings. For troubleshooters, Group Policy might seem to present a large number of potential problem sources, but compared to checking individual congura- tion settings on every workstation, troubleshooting Group Policy is a pleasure.  ■ Recognize problems caused by Group Policy. ■ Understand the various ways that workstations can fail to receive Group Policy settings. ■ Use Group Policy troubleshooting tools.   Group Policy is simply a mechanism for deploying registry settings to Windows computers on a network. When a user reports that a computer is not functioning properly, in many cases the cause can be traced to an improperly congured registry setting, but that does not necessarily mean that it is a Group Policy issue. The Windows Control Panel and the Registry Editor are also capable of modifying registry settings, and it is the troubleshooter’s job to determine how and why the registry was congured incorrectly. For example, you might trace a particular problem to a specic registry setting, but manually altering that setting does no good if there is a Group Policy object that restores the incorrect setting each time the computer restarts. Therefore, one of the rst things a successful Group Policy troubleshooter should know is how your particular organization uses Group Policy. Familiarity with the Group Policy objects deployed to the network and the settings they contain is the best way to determine whether a computer problem is the result of a Group Policy issue and where in the Group Policy infra- structure the cause of the problem is located. Lesson 2: Troubleshooting Group Policy Issues   When faced with a problem report that involves Group Policy, one of the rst questions the troubleshooter should ask is whether the behavior the user is experiencing is intended or not. For example, administrators can use Group Policy to suppress certain operating system features and interface elements that they do not want users to see. Some users, noting that the interface in their work computers look different from that of their home systems, might think that something is wrong, when in fact the interface is limited by design. Situations like these are simply a matter of educating the user. However, after you have determined that a computer is malfunctioning because a particular setting is not congured, or not congured correctly, you must then determine how the setting is supposed to be congured. In a properly planned and documented Windows 7 deployment, this information should be part of the workstation conguration, as discussed in Chapter 4, “Conguring Clients.”  One of the most fundamental Group Policy issues that can affect Windows 7 performance is the failure of the Group Policy settings to reach the workstation. Administrators can congure settings correctly in a Group Policy object, but if they fail to deploy the GPO correctly, the workstations might not receive that GPO and the settings it contains. After you determine that a workstation is experiencing a problem because a setting that should be congured using Group Policy has not been congured, you should be able to consult the documentation for your network to determine how the missing setting should have been deployed. In other words, there should be a record somewhere of which GPO should contain the setting and how that GPO should be deployed in AD DS. If no such record exists, you might have to begin the more arduous process of examining the GPOs in your domain and locating the one that contains—or should contain—that specic setting. Note            Troubleshooting Internet Explorer and Group Policy Issues There are many possible reasons why Windows 7 workstations might not be receiving the Group Policy settings they need. Some of the most common reasons are discussed in the following sections.  After creating a GPO, you deploy it by linking the GPO to an AD DS domain, site, or organiza- tional unit (OU) object using the Group Policy Management console. When you create a link between a GPO and an AD DS object, the console enables the link by default, as you can see by looking at the Link Enabled column, as shown in Figure 11-13.  Enabled links between GPOs and AD DS objects However, you can also disable a link by right-clicking the GPO and, from the context menu, toggling the Link Enabled indicator. This prevents the computers on the network from applying the settings in the GPO. One of the rst things you should check when you are troubleshooting Group Policy issues is whether all of the GPOs are linked to appropriate AD DS objects and whether the links are enabled. You might nd, for example, that another administrator disabled a link while working on the GPO and forgot to enable it again.  When you link a GPO to an AD DS domain, site, or OU, all of the objects in that container receive the settings in the GPO. If a workstation fails to receive the Group Policy settings it is supposed to have, it may well be because the computer or user object is not located in the correct container. If, for example, you create a monolithic GPO for workstations in the Sales department and link it to the Sales OU, a computer mistakenly placed in the Marketing OU instead of the Sales OU does not receive those settings. In the same way, if you create a large number of functional GPOs and you mistakenly link one of those to the Marketing OU instead of the Sales OU, the Sales computers do not receive all of the settings they need. Lesson 2: Troubleshooting Group Policy Issues    Group Policy objects have both Computer Conguration and User Conguration settings, and in some cases, there are identical settings that you can assign to either computers or users. When you are troubleshooting a Group Policy issue, you must be conscious of whether the settings a workstation is missing are assigned to the computer itself or the user operating it. For example, a problem might appear on a workstation not because the GPOs are improperly congured, but rather because the user who is logged on is not a member of the proper security group. Testing this theory might be as simple as logging on with a different user account and trying to re-create the error.  When workstations fail to exhibit the correct Group Policy settings, one possible explanation could be that the system has not yet received a recently congured GPO. To make sure that a computer is up to date in its Group Policy settings, you can restart the system or open a command prompt window and type the following command: gpupdate /force  Checking GPO links and object placement is relatively easy when you are dealing with a simple, at domain. However, when you have an AD DS hierarchy with multiple layers of OUs, inheritance becomes a critical part of Group Policy deployment and troubleshooting. By default, when you link a GPO to an AD DS object, the settings in that GPO are inherited by all objects subordinate to the linked object. Most enterprise administrators design their AD DS hierarchies with this tendency in mind. By linking GPOs with more general settings to objects higher up in the AD DS hierarchy, they can then link GPOs farther down that contain only the settings needed by specic workstation types. This makes it easier to maintain and troubleshoot Group Policy because the more general settings are located in only one, or a few, domain-level GPOs, rather than in a dozen or more OU-level GPOs. For this arrangement to function properly, however, the OUs farther down in the hierarchy must inherit the settings from those farther up. This inheritance, as mentioned earlier, is the default behavior, but there are several mechanisms that can interfere with it, as discussed in the following sections.   Troubleshooting Internet Explorer and Group Policy Issues  When you right-click an AD DS object in the Group Policy Management console, and in the context menu, activate the Block Inheritance toggle, the object appears with an exclamation point icon, as shown in Figure 11-14. With this feature activated, the object does not inherit any GPO settings from the parent objects above it. Only the GPOs linked directly to the object that has the block take effect.  Blocked inheritance in the AD DS hierarchy The use of inheritance blocks as a permanent architectural feature of an AD DS hierarchy is generally not recommended because it complicates the administration process and often leads to redundant GPOs and other components. However, troubleshooters should check for existence of blocks, whether temporary or permanent, as a possible cause for workstation Group Policy failures.  As a result of AD DS inheritance, a single object can receive settings from multiple GPOs, and those settings might conict. Therefore, it is part of the troubleshooter’s job to understand how the settings from multiple GPOs interact. The basic rules for GPO application are as follows: ■ GPOs linked to AD DS objects take precedence over local GPOs. ■ GPOs linked to OUs take precedence over GPOs linked to domains and sites. ■ GPOs linked to domains take precedence over GPOs linked to sites. ■ GPOs linked to lower-level OUs take precedence over those linked to higher-level OUs. ■ When multiple GPOs are linked to a single object, the GPO linked rst takes precedence. Lesson 2: Troubleshooting Group Policy Issues   Windows computers apply GPOs with lower precedence rst so that their settings can be overwritten by the GPOs with higher precedence. In the Group Policy Management console, when you select an AD DS object, the Linked Group Policy Objects tab displays the GPOs linked directly to that object, as shown in Figure 11-15. The GPO at the top of the list— that is, the one with the lowest number—has the highest precedence and is applied last. Administrators can modify the precedence of the links using the arrow buttons to the left of the list.  The Linked Group Policy Objects list in the Group Policy Management console The Group Policy Inheritance tab, shown in Figure 11-16, lists all of the GPOs applied to the object, including those inherited from parent objects.  The Group Policy Inheritance tab in the Group Policy Management console   Troubleshooting Internet Explorer and Group Policy Issues  Enforcing a GPO, by right-clicking it and selecting Enforced from the context menu, moves it to the top of the precedence list, as shown in Figure 11-17, and prevents any other settings from blocking it.  An Enforced GPO in the Group Policy Management console  By default, Windows applies the settings in a GPO to the Authenticated Users special identity, but administrators can use Group Policy’s security ltering feature to modify this behavior and limit the settings to specic users, groups, and computers. If workstations are not receiving the settings they need, be sure to check the security ltering feature in each GPO, as shown in Figure 11-18.  Security filtering in a GPO Lesson 2: Troubleshooting Group Policy Issues    As you have seen, many factors can interfere with Group Policy distribution, and examining individual GPOs and their links to AD DS objects for each of these factors can be a laborious task. Fortunately, Windows includes tools that enable you to work backwards from the client instead. Gpresult.exe is a command-line program that enables you to view information about the Group Policy settings that apply to a particular client workstation. In other words, you can use this tool to see which GPOs are operating for that computer. In its simplest form, you can run Gpresult.exe with the /r parameter from the command prompt on any Windows 7 computer. This produces a display that lists the GPOs supplying the computer and user settings to the system, part of which is shown in Figure 11-19.  Using Gpresult.exe at the command prompt In addition, the program is capable of generating a report in HTML format, which lists all of the policy settings applied to the computer and the user, as shown in Figure 11-20. [...]... 2 105 ms 92 ms . 4 69 Lesson 1: Troubleshooting Network Issues . . . . . . . . . . . . . . . . . . . . . . . . . 470 Troubleshooting Wired Network Connections 470 Troubleshooting Wireless Network Connections 4 79 Troubleshooting. essential tool for Windows administrators at all levels. For desktop administrators, Group Policy eliminates the need to manually congure dozens, if not hundreds, of individual Windows 7 settings book.  Adrian is a desktop administrator for Contoso, Corp. He has recently completed a large deploy- ment project in which he upgraded 200 Windows XP workstations to Windows 7. Unfortunately,