I've been helping out with some issues found on some development workstations. Fairly simple things like the user not being able to change wallpaper and stuff like that. When the image leaves the team that do the images they are quite locked down but as these are going to be development we want them unlocked a little.

Simple enough, Stick them into an OU, add in a GPO that unlocks the setting, job done.

The problem occurs when something crops up that not easy to fix in a GPO or not something we can fix in a GPO. You see, this is where it all gets convoluted because the team I'm in can only set GPO's for development machines and even then it's computer GPO's and not user GPO's - I'm sure some are asking if there is a difference? and the answer is oh hell yes.

Anyway, had a classic of a problem today. the group everyone was denied permissions to c:\documents and settings. Not pretty. The troubleshooting went a little like this:

User: "I get access denied to c:\documents and settings"
Service desk: "You have a development machine?"
User: "Yes"
Service desk: "not our problem, talk to the R&D GPO people, its a GPO issue"
Me: "How can it be a GPO issue? We don't have any GPO's that muck around with permissions"
Service Desk: "GPO Issue"
Me: "What about the Corporate images? Do they have the same problem? If not then it's not GPO but a user issue but a regular service desk call"
Service Desk: "GPO Issue"
User: "I just want it fixed" (Understandably)
Me: "We don't own these images and are just lending a hand, I can change the permissions if that'll help?"
Service Desk "YES!! Via GPO!"
Me: headdesk
Me: "No, as a one off but we need to have a look at the image"
Service Desk: "GPO Issue and we are not allowed to talk to the team that makes the images"
Me: "Excuse me? Why not? If you find a problem with the image what do you do?"
Service Desk:"Reimage the machine and part of the contract states we can't talk to the imaging team".
Me: "..."

So now I'm talking to the imaging team or rather I've sent them an email. It seems that our wonderful contract with the service desk doesn't actually allow them to own a problem so they just shove it away or just reimage a machine knowing that it's a temporary fix (and netting them £350 in the process).

sighs