Group Policy applies User settings but not Computer settings.

I am setting up a new Windows Server 2008 R2 with a test environment of a Windows 7 PC and a Windows XP PC.  I have created Users and Groups and defined several GPOs for different Groups, where generally each set of Users in a Group have been placed in their own OU, and the test PCs are in separate sub-OUs for each Operating System (Win7 and WinXP) beneath an OU for Computers.

When testing various GPOs I find that settings for both Users and Computers work for the Users on WinXP PCs, but only for Users on Win7 PCs.  I have run RSoP on the test Win7 PC when logged in as different Users, and on each occassion a message saying "access denied" for the computer settings in the GPO, and "no data collected" in the results.

I cannot see any relevant Events in the Event Logs that would help.  I have disabled UAC on the Windows 7 test PC, but no change.

What access permissions are not applied so that the GPO's Computer settings work?
Anthony WhitbyIT Systems SupportAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Not seeing results in policy doesn't mean that computer policy is not applied, it just means that the current user is not having permission to see the policy applied.

On Windows Vista and later, regular users can only see the user half of the
RSoP by default. They must be delegated the “Read Group Policy Result data” right over the computer they want to gather the information for.

Go on GPMC , click on GPO , go to delegation tab & then for the group of users click on Permissions Drop Down & then assign them, Read Group Policy Results Data.

Log on W7 machine, run gpupdate /force & then see gpresult.

Anthony WhitbyIT Systems SupportAuthor Commented:
Thanks  -  I think you are on the right track.  When I login as domain administrator onto Win7 PC and re-run the RSoP for the previous user on that PC I get both Computer and User settings displayed.

Then on the server I opened GPMC, selected a GPO, selected delegation tab,  right clicked on a user group and the drop down list showed:-
Edit settings
Edit settings, delete, modify security

No trace of "Read Group Policy Results Data"

This is on a server 2008 R2 - is it different here?
Active Protection takes the fight to cryptojacking

While there were several headline-grabbing ransomware attacks during in 2017, another big threat started appearing at the same time that didn’t get the same coverage – illicit cryptomining.

Anthony WhitbyIT Systems SupportAuthor Commented:
I would be much happier testing my GPOs if I could see the RSoP for each user on the logged on PC.  I suppose that I could make each user a (temporary) member of Domain Admins just to run the RSoP but is really distorting the results!
Why don't you just run RSOP from GPMC on Server?
But before you do that, enable this policy so firewall lets you go through:

Computer Configuration | Policies | Administrative Templates | Network | Network Connections | Windows Firewall | Domain Profile | Windows Firewall: Allow Inbound Remote Administration Exception

One more thing, the user has to logon once on the PC of which you want the RSOP to run.

Let me know, if that works for you?

Any News?
Anthony WhitbyIT Systems SupportAuthor Commented:
I have found that I have to disable the Windows Firewall as it applies to the Domain so that I can get GPOs to work for Computer as well as users with Windows 7 client PCs and 2008 R2 server OS.
How did you reach to that conclusion?
Anthony WhitbyIT Systems SupportAuthor Commented:
I was getting "Access denied" errrors when trying to implement the Computer settings in a GPO - there seemed to be a connection between the Firewall settings and being able to browse PCs from the server 2008 R2.
As a test can you please give one of the client a Static IP with Primary DNS specified?
See, the policy I gave you up is actually poking a hole in Firewall to run RSOP from the GPMC.
However, even if the Firewall is on it should not restrict from applying GPO.
If that is happening then there is something to be resolved, as you don't want to bring the Firewall down (I guess).
But, even if you bring down the Domain Firewall, it shouldn't matter much. (that is purely your decision).

Just for bit of convenience you can configure these two GPO's also at Domain Level:
1) Computer Configuration | Policies | Administrative Templates | System | Logon Always wait for the network at computer startup and logon policy

This GPO will make sure that all the GPO's apply before the user log's on. That way you will be sure that policies are applied before user get's in.

2) Computer Configuration | Policies | Administrative Templates | System | Verbose vs Normal Status messages

This will make sure that you not only see the stupid windows circle when the user logs on, but tells you exactly what is happening as to what policies are being applied.


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Microsoft Legacy OS

From novice to tech pro — start learning today.