As Ned Flanders would say, "I'm in one dilly of a pickle".
I'm a new System Administrator digging through and learning about AD, GP, etc. for the first time. A while back, I used the Microsoft Deployment Workbench to create a newer version of our Windows 7 Deploy image. I deployed this image to a few machines, and everything appeared to work (software was deployed, printers were mapped correctly, etc.). The only problem I ran into was that the computers couldn't communicate to our network shares.
After a bit of digging and some troubleshooting, we found that they weren't playing well with Samba. The setting that fixed the issue was in Control Panel -> Administrative Tools -> Local Security Policy -> Local Policies -> Security Options
-> Microsoft network client - digitally sign communications (if server agrees) - (Change from ENABLED to DISABLED). After this changed, the computers saw the shares, and everyone was happy. We also changed Microsoft network client - digitally sign communications
(Always) to "DISABLED".
The problem, however, is that the first setting (if server agrees) setting is set to enabledon machines that have the old image, and they work correctly. Additionally (and this is the crux of my question), a LARGE NUMBER of settings in this local security options are defined in our Default Domain Policy GPO...and they're not getting set!
For example, the other setting I changed - Microsoft network client - digitally sign communications (Always) to "DISABLED" - was already set to disabled on the machines with the older image via GP.
I've enabled a ton of logging, and dug through as much as I can, but I'm not finding anything that's jumping out at me. What would cause some settings not to be applied ONLY for this new image?
Here is a link to the log I'm looking at: https://mywebspace.wisc.edu/tnchristian/work/gpsvc.log
And the report generated by GP on an affected machine: https://mywebspace.wisc.edu/tnchristian/work/Report.html
Thanks in advance for any help!