Red / Green: GP Preferences doesn’t work even though the policy applied and after gpupdate force

I set a Preference setting, but it didn’t work. The answer? Probably F5-F6-F7-F8.

 

GP Preferences has a ton of compelling reasons to use it; the functionality allows admins to configure settings that are difficult to impossible to achieve through policy (deploying shortcuts, setting up drive maps, managing devices…) and the configuration UI is eerily familiar to what the user’s UI looks like to configure the same settings. Pretty easy to figure out where everything is when you already know the layout, right? The subtlety, however, is in knowing when you have actually set the configurations to be captured in the preference item and set to be applied with F5-F8 keys, indicated by the red or green icons.

 

This is my favorite example of the sweet UI and the subtle differences. These are the Internet settings options I see as a user for IE7:

 

 

 

And these are the same two tabs in Preferences. Notice the only difference in the Preference dialogs vs. the user is the right-most Common tab (where all of the interesting targeting and special behavior rules can be set up). 

 

 

The other difference is the red dashed line or green circles that hover around the configuration options. What does this mean? Why is it there? And more importantly…how am I supposed to use it?

 

Look at all those options you can adjust in the Advanced Tab; that’s a lot of granularity and a lot of work to get exactly right. Instead of forcing admins to modify every single setting when they configure an IE option, Preferences offers the ability to pick and choose which setting choices the admin wants to be pushed out. Those that are red underlined (or have a red circle next to them) are going to be ignored. Those that are underlined with a green solid line (or next to a green circle) are going to be noted, captured in the GPO, and enforced on the target user or computer. So I can make a Preference item that only captures three or four settings out of a whole menu of settings. Cool, right?

 

 

 

To ensure you aren’t pushing out unwanted settings, settings are ignored by default; this is indicated with red-dashed-underlined or a red circle icon. This is true of the home page, for example (you can see the red dashed line in the image above). If you do not consciously make the choice to have these settings captured, they will be ignored. No green line/circle, no configuration. This is what causes most people to have issues with Preferences; they go through all the work of configuring the settings they want, set up targeting, link the GPO, gpupdate…nothing changes. The GPO applied in the report, but what happened? The settings were still set to be ignored, so nothing was pushed out.

 

 

The mechanism to specify or ignore settings is controlled by the F5 – F6 – F7 – F8 keys. They are grouped in pairs by outside keys (F5, F8) and inner; (F6, F7). The outer keys manage all the settings at once; F5 makes everything count, all the settings get green-underlined. F8 sets them all to be ignored, red-dashed-underline. F6 and F7 work on individual settings; F6 will light up one setting at a time, F7 will set one setting to be ignored. Here’s a diagram, hopefully it doesn’t make it more confusing. I’ll write up some examples for the next blog post, hope this helps so far!