Solved

Manually Fix KB3159398

Posted on 2016-07-31
7
158 Views
1 Endorsement
Last Modified: 2016-08-01
I posted this a day or two ago and guess I didn't get enough detail. I thought the simple fix was to add Authenticated Users under Delegation and give them Read privileges but I don't think this is correct. Don't they need Read and Apply GPO?

Secondly I thought Authenticated Users (Read and Apply GPO) was just a standard, every GPO should have it under Delegation, but when I add Authenticated Users under Delegation it also adds Authenticated Users under Scope. I don't want that. I have a specific security group under Scope and when added that group is automatically put it under Delegation with Read and Apply GPO permissions.

So I am a little confused about what KB3159398 actually did. I don't really want to add caret Blanche add Authenticated Users under Delegation where ever it is missing do I?
1
Comment
Question by:LockDown32
  • 3
  • 3
7 Comments
 
LVL 7

Expert Comment

by:Senior IT System Engineer
Comment Utility
You can check it first using this PowerShell script:

#Load GPO module
Import-Module GroupPolicy
#Get all GPOs in current domain
$GPOs = Get-GPO -All
#Check we have GPOs
if ($GPOs) {
#Loop through GPOs
foreach ($GPO in $GPOs) {
#Nullify $AuthUser & $DomComp
$AuthUser = $null
$DomComp = $null
#See if we have an Auth Users perm
$AuthUser = Get-GPPermissions -Guid $GPO.Id -TargetName “Authenticated Users” -TargetType Group -ErrorAction SilentlyContinue
 #See if we have the ‘Domain Computers perm
$DomComp = Get-GPPermissions -Guid $GPO.Id -TargetName “Domain Computers” -TargetType Group -ErrorAction SilentlyContinue
 #Alert if we don’t have an ‘Authenticated Users’ permission
if (-not $AuthUser) {
#Now check for ‘Domain Computers’ permission
if (-not $DomComp) {
                Write-Host “WARNING: $($GPO.DisplayName) ($($GPO.Id)) does not have an ‘Authenticated Users’ permission or ‘Domain Computers’ permission – please investigate” -ForegroundColor Red
}   #end of if (-not $DomComp)
else {
#COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT!
               Write-Host “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) does not have an ‘Authenticated Users’ permission but does have a ‘Domain Computers’ permission” -ForegroundColor Yellow
}   #end of else (-not $DomComp)
}   #end of if (-not $AuthUser)
elseif (($AuthUser.Permission -ne “GpoApply”) -and ($AuthUser.Permission -ne “GpoRead”)) {
#COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT!
Write-Host “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) has an ‘Authenticated Users’ permission that isn’t ‘GpoApply’ or ‘GpoRead'” -ForegroundColor Yellow
}   #end of elseif (($AuthUser.Permission -ne “GpoApply”) -or ($AuthUser.Permission -ne “GpoRead”))
else {
   #COMMENT OUT THE BELOW LINE TO REDUCE OUTPUT!
            Write-Output “INFORMATION: $($GPO.DisplayName) ($($GPO.Id)) has an ‘Authenticated Users’ permission”
        }   #end of else (-not $AuthUser)
    }   #end of foreach ($GPO in $GPOs)
}   #end of if ($GPOs)

Open in new window


From: https://blogs.technet.microsoft.com/poshchap/2016/06/16/ms16-072-known-issue-use-powershell-to-check-gpos/

And then manually add the permission one by one a necessary.
0
 
LVL 15

Author Comment

by:LockDown32
Comment Utility
Thanks but it is the manual permissions I am questioning.....  please see the question.....
0
 
LVL 10

Expert Comment

by:Maclean
Comment Utility
If you have a GPO targeted at a group named lets say "Finance-Users" you still need to add Authenticated Users under delegation with "Read" only selected (Deselect "Apply Group Policy" under Authenticated users)

If you need the policy to work for all authenticated users then you need to set both "Read" and "Apply Group Policy"

You do not need to add "Write" permissions etc to Authenticated users (Not recommended ever on authenticated users)

Capture.PNG
0
Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

 
LVL 15

Author Comment

by:LockDown32
Comment Utility
That is where the questions come in on manually fixing it. You are saying at the very least, under the delegation tab, that every GPO should have Authenticated Users, Read, checked and if it is targeting the Group Authenticated Users Apply Group Policy should be checked too?
0
 
LVL 10

Accepted Solution

by:
Maclean earned 500 total points
Comment Utility
Yes correct. So just to keep it simple.

If targeting specific groups, you need authenticated users added under delegation, but only the "Read" option should be allowed. Remove allow on all other area's

If the target is Authenticated Users, then this box & the Apply Group Policy should both be allowed.

If the Apply Group Policy is not allowed, then "Authenticated Users" would not show under the target scope on the GPO post creating it, and the policy will not work for anyone.

To test run gpresult /r /scope:computer on a workstation where a item targeted policy is not applying & check that it shows with an error such as "Error unknown" or "GPO Denied"
Then on Group Policy add Authenticated Users with Read only to that GPO, go back to workstation, reboot and run gpresult /r /scope:computer again. (You can leave the /scope:computer out if the policy is user based.)
0
 
LVL 15

Author Comment

by:LockDown32
Comment Utility
OK. I corrected the Delegation but still no luck. GPRESULT /H on this workstations shows none of the GPOs linked to the Computers OU as being either Applied or Denied. Screen shot and GPRESULT attached,
Capture.PNG
gpresult.html
0
 
LVL 10

Expert Comment

by:Maclean
Comment Utility
Just on a side note. Computer GPO's do not show on GPRESULT /R It shows User Settings only.
You need to run GPRESULT /R /SCOPE:COMPUTER from an elevated CMD Prompt, if running it from client side in order to view the Computer Settings. But that's different from the GPO Results wizard attached here.

It looks from screenshot that Computer objects focused GPO's are set under SBSComputers correct.

Can you confirm that the computer which you ran the wizard against is in this OU.
In addition can you confirm if this problem applies to all systems tested, or only this one single computer please.
And finally did you check this after waiting for replication to finish. It can take some time unless you manually kicked of replication.
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

Installing a printer using group policy preferences is not that hard let’s take a look at it. First lets open up your group policy console and edit the policy you want to add it to. I recommend creating a new policy for each printer makes it a l…
[b]Ok so now I will show you how to add a user name to the description at login. [/b] First connect to your DC (Domain Controller / Active Directory Server) SET PERMISSIONS FOR SCRIPT TO UPDATE COMPUTER DESCRIPTION TO USERNAME 1. Open Active …
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

9 Experts available now in Live!

Get 1:1 Help Now