1

Good morning,

A single Windows Server 2008 R2 serves a small domain with a dozen Windows 7 Pro workstations. All machines are fully patched. A GPO exists to give one specific workstation a non-default firewall port opening for RDP. That’s the only setting in the GPO.

The GPO has existed for some time, and recently it failed to apply. The Group Policy Results Wizard showed it failed to apply due to it being “Inaccessible”, and instead of the name of the GPO, it showed the Unique ID of the GPO.

After messing with it unsuccessfully for a bit, even Delegating Everyone Full Access to the GPO, I deleted the GPO and recreated it. The new GPO is shown to apply in Group Policy Modeling, but does not appear at all in Group Policy results, not even as Denied or as Inaccessible as it did before.

This has me puzzled, and stumped. It’s a Computer Setting only GPO, the Computer is Delegated Read and Apply rights. I expected it to at least show up as either Allowed or Denied. Where do I go from here?

Thanks!

4 Spice ups
2

Since it sounds like you scoped the GPO to only Computer accounts, try adding Authenticated Users with READ permissions in the delegation tab of your new GPO for troubleshooting (And then leave it there as it’s best practice)

This may help with figuring out why it’s not applying. by running rsop or gpresult with a gpo without ‘read’ access to the GPO, you may not get the full reasons why it is not applying.

2 Spice ups
3

Hi,

allow Read Access to " Authenticated Users" or “Domain Computers” and it will work once again.

Microsoft changed the security settings regarding the application of group policies in June 2016, and you are witnessing the fallout in your network.

See: Deploying Group Policy Security Update MS16-072 \ KB3163622 | Microsoft Learn

Grüße,

Philip

2 Spice ups
4

As suggested, Authenticated Users was added to the scope. The Scope is now Authenticated Users and the Computer it applies to. The results are the same: Group Policy Modeling (for the specific user on the specific computer) shows the GPO is applied, and Group Policy Results does not show the GPO at all, either Applied nor Denied, by name or by Unique ID.

ETA: After rereading the replies, I also added Domain Computers to the scope. Same result as above.

5

Follow the trouble shooting steps on this page:

1 Spice up
6

Problem Solved: I discovered there was a copy of this GPO under Group Policy Objects, named “Copy of “GPO Name””. Although the copy was not linked to any OU, once it was deleted, the Group Policy Results showed the policy was applied as expected.

Following this, the Scope was trimmed back down to only the computer object it was intended for, Group Policy results was rerun, and the policy still applies as expected.

The copy must have been having an adverse affect on the linked original.

Thanks for the suggestions.

1 Spice up
7

I know this is an old post but it came up when I was searching so I thought I would add what I found to be my problem with “GPO not applying”.

This article on TechNet nailed it for me. Scope was wrong. In particular “Remember, GPOs cannot be linked to an OU that just contains security groups.”

Once I linked the GPO to the OU with all of our systems it worked fine. We were using OUs to separate out systems we wanted certain GPOs to apply too (NOT ideal, but like that when I got here) instead of using filtering. Now I just need to link our other GPOs and then edit filtering on certain GPOs so they don’t apply. (Like should have been done in the first place.)