Solved

Group policy filtered to a group not applying to users

Posted on 2016-08-01
6
24 Views
Last Modified: 2016-10-08
We are having a issue where the group policies filtered to a group are not applied to the users in windows 2012 domain. These policies used to work fine earlier. If we apply the same policy to authenticated users group then it applies fine.
This policy has user settings but is applied to server OU. Gpresult does not show this policy at all in applied user policy listing or denied list.
When I run modelling wizard it shows up but lists under denied due to filtering. And also complains about "ad / sysvol version mismatch". If I run Rsop for 1 user then it does not show the settings related to this policy.
Recently we moved the Pdc, infrastructure master and rid master roles  to a second DC. That was done to split the roles on 2 DCs as we have 3 DCs. Please let me know what can I look at to resolve the issue.
0
Comment
Question by:mc7
  • 2
  • 2
6 Comments
 
LVL 38

Assisted Solution

by:Adam Brown
Adam Brown earned 175 total points (awarded by participants)
Comment Utility
If it has User policy settings in it, it needs to be linked to an OU that has user objects in it. Computer objects will not apply User Configuration policies unless policy loopback processing is enabled. If you want the GPO to only apply to users that log in to those servers, enable loopback policy processing. https://blogs.technet.microsoft.com/askds/2013/02/08/circle-back-to-loopback/ has good info on it, if that's what you're trying to do. Otherwise, you'll need to change your links so it is linked to an OU with the user objects you want it to apply to in it.
0
 
LVL 23

Accepted Solution

by:
Coralon earned 200 total points (awarded by participants)
Comment Utility
If it works with Authenticated Users, but not when you modify the security, then chances are excellent you are not adding Domain Computers back to the security.  Ultimately, the computer is what has to read in the GPO, and if you don't give it the rights, it can't read the policy, and therefore it does not apply.

Coralon
1
 
LVL 18

Assisted Solution

by:Jeremy Weisinger
Jeremy Weisinger earned 125 total points (awarded by participants)
Comment Utility
I agree with Coralon. User policies are read using the computer context of the computer the user is logged onto. If it used to work then stopped it is because this is a recent change from Microsoft. In June Microsoft released a patch that changed how the policy is retrieved from the user context to the computer context. You can read more about it here: https://blogs.technet.microsoft.com/askds/2016/06/22/deploying-group-policy-security-update-ms16-072-kb3163622/
0
 
LVL 38

Expert Comment

by:Adam Brown
Comment Utility
The answers given here do adequately answer the question together. If the GPO (which has user settings in it) is linked to an OU that contains computer objects (as was mentioned), Loopback Policy Processing is required, which is what I recommended. The other answers note that the computer objects need to be included on security filtering to apply the GPO as well. The answers given provide either part of or the entire solution for the explained issue and should be credited.
0
 
LVL 23

Expert Comment

by:Coralon
Comment Utility
Comments did provide the correct information to resolve the issue.
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

The saying goes a bad carpenter blames his tools. In the Directory Services world a bad system administrator, well, even with the best tools they’re probably not going to become an all star.  However for the system admin who is willing to spend a li…
Installing a printer using group policy preferences is not that hard let’s take a look at it. First lets open up your group policy console and edit the policy you want to add it to. I recommend creating a new policy for each printer makes it a l…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now