Viewing Active Policies
If ActivClient policies are configured by GPOs or by local policies, there can be several policies affecting the behavior on the local workstation.
About Group Policy Processing in a Microsoft Windows Environment
-
Group Policy settings for computers are processed in the following order:
-
Local
-
Site
-
Domain
-
Organizational units (from the highest OU in hierarchy to the lowest, meaning that the lowest OU setting takes precedence over higher ones).
This order means that the local Group Policy object is processed first, and Group Policy objects that are linked to the organizational unit of which the computer or user is a direct member are processed last, which overwrites the earlier Group Policy objects. Go to http://technet.microsoft.com/en-us/library/cc778890(WS.10).aspx for more information.
-
Group policies are applied to the computer when they are connected to the domain. So even if a user logs on to Microsoft Windows offline, with cached domain credentials, the last group policy objects are applied and cannot be modified.
-
Group Policy refreshes policy settings at a regular interval, which is every 90 minutes by default. This value is configurable by a Group Policy administrator.
-
Group policy refresh can also be enforced by executing the command line gpupdate /force.
ActivClient Resultant Set of Policies
ActivClient includes a utility that displays the 'resultant set of policies' active on the workstation. It is recommended that you use this utility to check that policies set on the domain controller are properly pushed to the workstations.
-
From the ActivClient User Console, select Tools, then Advanced and then View Policy Settings….
You are prompted for administrative privileges, if applicable.
-
You can view the HID Global ActivClient policies in the Administrative Templates folder.
For each policy, you can view, but not edit, the policy value.
Only the configured policies (that is, policies set to Enabled or Disabled) are displayed.
If policies are Not Configured (which is the default), they do NOT display. In other words, this tool displays only the policies that differ from the default ActivClient configuration. In a default configuration (no customization), the ActivClient folder under Administrative Templates will not display.
