So, upon rebooting several of the machines, I realized that the group policy did indeed get applied on the successful restart.

Question to Microsoft: Why doesn’t the “gpupdate” command update ALL of the group policy settings? This may be a silly (and old) question to some, but I think that if you make a group policy update tool, it should update the group policy, all of it.

What I learned is that group policy relating to user settings apparantly updates after logon and group policy relating to computer settings apparantly updates before logon (and isn’t affected by gpupdate). I could be wrong, but that’s what looks like is playing out on these machines.

Hmmmm… a little rant for today, but I’m glad that it works. Now my network time is now synced via NTP (SNTP actually), and the users can’t change it.

We launched our network time clock last week. Yes, we’re finally saying goodbye to “punching in.” It was an interesting implementation with very limited documentation, but we’re up and running now. We’ve launched the first phase with our facilities and kids workers.

So, it’s a little hinky. The maintenance staff have to log-in to a computer, open the time clock, click the button, enter their employee number, choose the job code, and click clock in. It’s just a few more steps than remove your card, punch it, replace the card. With the kids workers, we were surprised that it was the first time that one of the ladies had ever used a mouse. Still, the convenience this brings to our financial team is worth the hinky behaviors.

WARNING: GROUP POLICY IGNORANCE AHEAD

We learned that it is possible for employees to change the system time to tweak the amount of hours they worked. Now, it’s not a huge issue in a church, but we don’t want it to be a temptation either. So, today I started playing with Group Policies and the registry editor. I now have the entire domain synced with the us.pool.ntp.org time servers, which is a good thing that needed to happen anyhow. What I can’t figure out how to do is to prevent users with local administrator accounts from changing the system clock. I set the GPO to only allow Administrators to change the time. Still, they can change it. More Google’ing to come.