We value your feedback.
Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!
Course Of The Month
8 days, 5 hours left to enrollBecome a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Group policy filtered to a group not applying to users
Posted on 2016-08-01
We are having a issue where the group policies filtered to a group are not applied to the users in windows 2012 domain. These policies used to work fine earlier. If we apply the same policy to authenticated users group then it applies fine.
This policy has user settings but is applied to server OU. Gpresult does not show this policy at all in applied user policy listing or denied list.
When I run modelling wizard it shows up but lists under denied due to filtering. And also complains about "ad / sysvol version mismatch". If I run Rsop for 1 user then it does not show the settings related to this policy.
Recently we moved the Pdc, infrastructure master and rid master roles to a second DC. That was done to split the roles on 2 DCs as we have 3 DCs. Please let me know what can I look at to resolve the issue.
This policy has user settings but is applied to server OU. Gpresult does not show this policy at all in applied user policy listing or denied list.
When I run modelling wizard it shows up but lists under denied due to filtering. And also complains about "ad / sysvol version mismatch". If I run Rsop for 1 user then it does not show the settings related to this policy.
Recently we moved the Pdc, infrastructure master and rid master roles to a second DC. That was done to split the roles on 2 DCs as we have 3 DCs. Please let me know what can I look at to resolve the issue.
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
2
2
6 Comments
Active today
If it has User policy settings in it, it needs to be linked to an OU that has user objects in it. Computer objects will not apply User Configuration policies unless policy loopback processing is enabled. If you want the GPO to only apply to users that log in to those servers, enable loopback policy processing. https://blogs.technet.microsoft.com/askds/2013/02/08/circle-back-to-loopback/ has good info on it, if that's what you're trying to do. Otherwise, you'll need to change your links so it is linked to an OU with the user objects you want it to apply to in it.
Active today
If it works with Authenticated Users, but not when you modify the security, then chances are excellent you are not adding Domain Computers back to the security. Ultimately, the computer is what has to read in the GPO, and if you don't give it the rights, it can't read the policy, and therefore it does not apply.
Coralon
Coralon
I agree with Coralon. User policies are read using the computer context of the computer the user is logged onto. If it used to work then stopped it is because this is a recent change from Microsoft. In June Microsoft released a patch that changed how the policy is retrieved from the user context to the computer context. You can read more about it here: https://blogs.technet.microsoft.com/askds/2016/06/22/deploying-group-policy-security-update-ms16-072-kb3163622/
Active today
The answers given here do adequately answer the question together. If the GPO (which has user settings in it) is linked to an OU that contains computer objects (as was mentioned), Loopback Policy Processing is required, which is what I recommended. The other answers note that the computer objects need to be included on security filtering to apply the GPO as well. The answers given provide either part of or the entire solution for the explained issue and should be credited.
Featured Post
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
A project that enables an administrator to perform actions within a user session context not just at the time of login but any time later on day(s) or week(s) later.
Group policies can be applied selectively to specific devices with the help of groups. Utilising this, it is possible to phase-in group policies, over a period of time, by randomly adding non-members user or computers at a set interval, to a group f…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …
This video shows how to use Hyena, from SystemTools Software, to bulk import 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses
Course of the Month8 days, 5 hours left to enroll
729 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.