If you use Windows Server 2008 or the Remote Server Administration Tools (RSAT) for Windows Vista to enable the Group Policy Preference setting Allow active content to run files on My Computer the setting will remain disabled when the policy is applied on the client computers. If you disable the policy setting, you will find that it gets enabled on the client computers after the next Group Policy refresh.

The Allow active content to run files on My Computer is configured in the Group Policy Management Editor by navigating to User Configuration\Preferences\Control Panel Settings\Internet Settings and selecting New, then Internet Explorer 7. On the Advanced tab, scroll down to the Security section to view the Allow active content to run files on My Computer setting.

This is a rollup package of many hotfixes for the Group Policy Preferences Client-Side Extension. This package resolves the following issues:

• The Windows Event Log service crashes when the regional options preferences are set to English (United Kingdom).
• If you create or update a virtual private network (VPN) connection by using a Group Policy object, the connection does not bind to IP Version 4 (TCP/IPv4) or IP Version 6 (TCP/IPv6).
• A Lightweight Directory Access Protocol (LDAP) query that is used by item level targeting uses an incorrect base distinguish name.
• Group Policy Service (GPSVC) stops responding during the GPSVC shutdown process if third-party printer drivers are installed by Group Policy Preferences.
• The %GPTPATH% variable is not resolved correctly when Group Policy Preferences are processed.

Consider the following scenario:

• You use the Group Policy Management MMC snap-in to define and configure some policies in a domain.
• You do either of the following:
  • You export some group policies, and then you import them into the current domain or into a new one.
  • You copy some group policies, and then you paste them into the current domain or into a new one.

In this scenario, the importing or the pasting action reports a “successful” result. However, some random group policies are missing after the importing or pasting action is finsihed.

For example, you define a wired network policy in a domain, and then you export it. You then import the policy into a new domain. After the importing process finishes, the defined wired network policy is missing in the new domain.

On a client computer that is running Windows Vista or Windows Server 2008, you apply some Quality of Services (QoS) Group Policy settings under the following subsection:

Local Computer Policy\Computer Configuration\Administrative Templates\Network\QoS Packet Scheduler

When you log on to the client computer, you see the Group Policy settings are applied correctly. However, after you restart the client computer, the Group Policy settings are no longer applied.

For example, you enable the Group Policy setting “Guaranteed service type.” You specify a custom Layer-3 Differentiated Services Code Point (DSCP) value for packets with the “Guaranteed service type.” After you restart the client computer, the custom Quality of Service (QoS) DSCP settings in the Group Policy are not retained. In this scenario, the default value for “Guaranteed service type” is used by the operating system after the computer is restarted.

This problem occurs whether you apply the Group Policy settings by using the local policy, or by using Group Policy objects in an Active Directory domain.

This problem also occurs on a client computer that is running Windows XP or Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
972878 The “Guaranteed service type” Group Policy setting returns to the default value after you restart a client computer that is running Windows XP or Windows Server 2003

Consider the following scenario:

• On a Group Policy Management server, you open the Group Policy Management Editor to configure Group Policy Preferences for Internet Explorer 7.
• In the Group Policy Management Editor, you click to select one or more of the following check boxes on the User Configuration\Preferences\Control Panel Settings\Internet Settings\Internet Explorer 7\Advanced tab:
  • Check boxes under Accessibility
    • “Reset text size to medium while zooming”
    • “Reset Zoom level to 100% for new windows and tabs”
  • Check boxes under Security
    • “Allow active content to run in files”
    • “Allow software to run or install even…”
  • Check boxes under International
    • “Send IDN Server Names”
    • “Send UTF -8 URL”
    • “Show information bar for encoded address”
• You apply these settings to some computers that are running Windows Server 2008 or Windows Vista.

In this scenario, these Group Policy configurations are not deployed to client computers successfully. For example, under Security in the Internet Explorer 7 Group Policy Preferences, you click to select the “Allow active content to run in files” check box. However, in the Internet Explorer 7 Preferences on the client-side, this check box is not selected after the policy is applied to the client.

On a Windows Vista or Windows Server 2008-based computer, you configure the printer item in Group Policy Preferences. When you try to configure the printer item for printers that use third-party drivers, Group Policy Preferences stops responding (hangs).

When this problem occurs, you cannot perform other operations and you cannot log off the computer.

In the Active Directory domain environment, you configure a Group Policy object (GPO) for the Folder Options preference in Group Policy Preferences, and then you select the “Apply once and do not reapply” option for this Group Policy. In this scenario, after you log on to a computer that is running Windows Vista or Windows Server 2008, you see that the Folder Options preference in Group Policy Preferences is applied to the client computer. However, after you change some Folder Options in Microsoft Windows Explorer, log off, and then log on to the client computer again, the changes in the Folder Options are lost. The changes are also lost after the Group Policy is refreshed.

Note: The changes in the Folder Options preference in Group Policy Preferences are expected to be kept because the Folder Options GPO is configured as “Apply once and do not reapply.”

In an Active Directory domain environment, you configure the Limit profile size Group Policy setting to manage the size of user profiles. On a Windows Vista or Windows Server 2008-based client computer, if the user profile size is more than 4 GB the Group Policy setting does not take effect. You do not receive a message that the profile size is exceeded, and you can log off as usual even if the Max Profile Size field of the Group Policy setting is set to a value less than 4 GB.

When you use a roaming profile, you receive the following message:

Your roaming user profile was not completely synchronized. See the event log for details or contact administrator.

Consider the following scenario. You have a computer that is running Windows Vista or Windows Server 2008. You use the Group Policy Management snap-in of Microsoft Management Console (MMC) to browse Group Policy objects. However, when you select a Group Policy object, the Group Policy Management MMC snap-in responds slowly or even stops responding. In this scenario, you have to wait awhile before the MMC snap-in responds again.

Note: This problem usually occurs in a domain that has lots of organizational units (OUs). For example, you select a Group Policy object in a domain that has more than 100,000 OUs. In this example, it may take the Group Policy Management MMC snap-in about a half hour to resume responsiveness.

The Group Policy Preference Migration Tool (GPPMIG) is a command line application developed with version 3.0 of the .NET Framework. A user who has Domain Administrative Credentials can use GPPMIG to migrate PolicyMaker items to Group Policy Preference items into the same Group Policy object (GPO) or into a different GPO.