1

Hi - i had a hunch some GPO’s were not applying to machines in the domain.

I have confirmed this with running gpresult and some gpo’s do not get to the machine or even show as filtered out - no evidence at all.

When i run group policy modelling against a user (first time i have used this) all the policies that i want to see are there.

#confused

#PleaseAnyIdea’s

#ThanksInAdvance

:slight_smile:

2 Spice ups
2

If you have more than one DC then it can take ~2 hours for a GPO to replicate and be pushed down. If this is a new GPO then the client may need a reboot.

3

User or Computer policies? Try a new policy - a computer configuration policy with no filtering and with security “authenticated users”. Please post the result!

2 Spice ups
4

Do you have multiple DC’s? Is it possible the sysvol folder isn’t replicating between them?

5

Hi - yes 2 DC’s.

The policies in question are historic, but have been updated often. Im presuming then if replication is not working the policy wont run at all on the PC’s ?

6

It is easy enough to figure out if replication isn’t working. Is it only certain policies or any of them? Try setting something simple on an OU without any filtering and see if it gets applied.

7

Also check the connection speed between the DC’s and the client machines. Depending on how many policies there are, and what that speed is, Microsoft will flat out just skip over some policies to provide a faster boot time if the connection isn’t high speed.

8

Open up group policy and change domain controllers to check if policies are on both DC’s. It’s possible that they aren’t replicating the sysvol folder. If a user is authenticating to DC1, then they would be getting the polices from DC1…if they authenticate to DC2, then they would get the policies in DC2

2 Spice ups
9

Or just run some diags to see if replication is happening.

10

Are the clients in Nested OU’s? And what group is in the security filtering of the GPO?

1 Spice up
11

Yes, nested OU’s

The group is a manually created group with the appropriate users. But the gpo is also linked to an OU

hmmm i shall remove the group and replace this with ‘authenticated users’

1 Spice up
12

3 DC’s (my bad)

1 DC replication fails. Ive just learned this and manually copied the GPO to sysvol on the failing server. Will test in the morning

13

Let us know if that worked.

14

Manually copying GPOs will probably cause more issues than it will solve. Get the replication working or you are just band-aiding what needs to be fixed anyway.

3 Spice ups