In fact, Admin Template settings, which usually don’t tattoo a system under normal circumstances, end up getting stuck on machines once they’re removed from the domain, because the non-tattooing behavior of these settings requires normal domain GP processing to occur.
The challenge here is that, once a machine is removed from the domain, you don’t have any control over the policy settings that remain tattooed on them. The answer is to avoid the problem in the first place :). A recent thread on Mark Minasi’s forum site reminded me of a topic that comes up every once in a while–namely, how do you cleanly remove Group Policy settings from a machine that has been removed from an AD domain.
0 kommentar(er)
