1

Hello all!

I’ve set up a new domain and structured some GPOs accordingly.

I did not modify the default domain policy

I created the GPO and linked to the “computers” OU

Security filtering is set to authenticated users and I also added the computer directly (This shouldn’t be necessary but I wanted to test it to see if it worked, it did not)

running a GPUPDATE /FORCE is successful and doesn’t show any errors

GPUPDATE /R shows that group policy was applied from the DC

Applied group policy objects shows: N/A

Any idea why it is not pulling the settings?

4 Spice ups
2

It really depends on what GP settings are being applied. Many of them wont take effect until a PC is logged off and/or restarted. Can you give an example of one policy you’re trying to apply?

3

Did you make a new OU called computers? You cannot link GPOs to the built-in computers container.

Is the computer object in the OU that you linked the GPO to?

When you ran GPResul /r did you run command prompt as admin? Need to be admin to see computer policies.

What settings are you trying to apply that arent working?

4 Spice ups
4

Yes to what Justin said. The default “computers” folder is not an OU but considered a container. GPO’s (with specific exceptions) won’t link to the computers in that container. Please create a new OU structure and migrate your PC’s there.

You can even redirect new PCs to your new OU automatically with this

Redircmp “distinguished-name-of-OU”

And new PCs will automatically go into your new structure.

5

Obviously that redircmp is run from the command line on your DC. Just to be clear.

6

That right there. GPOs cannot be linked to containers, which the built-in Users and Computers are.

Objects in containers will inherit settings from up the hierarchy, so if you were to link the GPO at the domain level it would apply to objects in Users and Computers. It’s going to depend on how you organize your AD, but it’s usually not recommended to leave any objects there anyway.

7

You cannot link a GPO to a container. How did you do that!

What policy did you try to apply?

8

Whoa…not linked to a container!

I created an OU labeled “computers” > underneath that it is separated by department.

I have the GPOs at the top level of the computers OU

I also tested applying it to the individual folder (labeled by department), no luck

9

Try using the rsop (resultant set of policy) tool within the group policy editor, this will show you what will or will not apply to your specific computer/user.

Hell of a lot better than guesswork

10

Applied group policy objects shows: N/A

My experience says N/A does not mean that computer policies have not been applied.

11

Again, What policy did you try to apply?

12

RSOP shows nothing applied.

Just for testing I tried to apply one single policy"NTP Time Sync - Clients"

I also tried a Workstation restriction policy I created (has some basic settings like restricting control panel access, etc…)

Neither worked :frowning:

13

I assume you have rebooted the machine in question?

Sometimes that is the only way for GPOs to apply, in my experience.

14

Can you post the GPresult output? have you tried gpupdate /force

Did you confirm the computer object is in that OU?

Also in a domain environment, I would not mess with the default time sync settings.

15

Also remove control panel access is a User GPO. You would have to apply that to user objects.

16

Run Group Policy Modeling and Group Policy Results. The latter will tell you if something fails to apply.

17

Hey Guys,

Sorry I had to step away from this for a bit.

So circling back around.

I have one policy, a password policy, set on my computers OU. I have one computer in that OU.

Running gpupdate /force works.

Running RSOP.msc results in: “Unable to generate RSoP Data. In logging mode, likely causes are group policy has never successfully processed for the computer or user. RSoP logging was never enabled, or the data is corrupt. In Planning mode, verify that the selected domain controller supports RSoP” Details: NONE

I ran the Group Policy Modeling wizard on the computer in question and it shows the GPOs should be applied.

18

GPresult also shows nothing

19

You can only have one password policy per domain. Linking a new password policy to a computer OU would only affect local accounts to that computer.

The domain password policy is applied from the #1 linked GPO at the domain root, typically the default domain policy.

As a best practice, you should configure the Default Domain Policy GPO only to manage the default Account Policies settings, Password Policy, Account Lockout Policy, and Kerberos Policy.
20

I just added one that disables RC4 and it is also not showing. So I don’t think that is the issue.