Software policies being removed

A Lake wrote:

> I have a group of 30 PCs (identical hardware and created using sysprep'd
> image) that continually 'remove' all of their GPO Software policies.
>
> The logs show 'The removal of the assignment of application XYZ from policy
> XYZ succeeded.' for each software policy assigned to them. Then, the next
> boot results in all of that software being reinstalled.
>
> The PCs are never moved in AD, and they are not the only ones in that OU.
>
> If I assign a new software policy to that OU, the other PCs install as
> normal whereas this group reinstall every software policy as well as the new
> one!
>
> Anyone got any ideas why this might be happening? Or where to look to see
> why they think the software policies have been removed when they haven't?

So do the users of these problematic hosts have admin privileges on
their own hosts (which would have to be an admin on their host when
logging into the domain, not a local admin when not logging in under the
domain)? If so, anyone with admin rights to their own host can undo
policy changes. It's real easy using a .reg file ran by a shortcut in
the Startup group that runs "regedit.exe /s <undofile>.reg". You push
the domain policies when they login. They undo those policies using
gpedit.msc or have it automatically performed using a startup shortcut
or scheduled task that loads a .reg file. That's one possibility. I
know about this because I had to undo the company's policy regarding an
overly short timeout (15 minutes) for the screen saver on a shared host
to which we did not want to give out the login password needed to exit
the password-protected screen saver (but I had to be a domain admin [but
only for my particular host, not for the AD] and only after asking
permission to undo the policy from the IT folks).
 >> Stay informed about: Software policies being removed