1

Hey all,

I know this is a common issue, but none of the other answers I found have worked.

I have two GPOs that I need filtered to specific groups, but they always get denied due to security filtering error. I already added the Authenticated Users (Read) back in for Delegation and I even added Domain Computers (Read) to the Delegation as well and still get security filtering denied.

The only time the GPOs apply is if the security filtering has either Authenticated Users or Domain Computers listed in it, but of course then it applies to everyone and everything in the OU. I’m at a loss as to what I can do to resolve this.

Thanks,

Windows 2012 R2 Domain Level, Window 10 Pro 1803-1809 workstations.

5 Spice ups
2

When you run GPResult /r for that user do they show up in the Group you are using to filter the GPO?

If you just made these groups you will have to re-log the user to get new group membership.

A read delegation for Authenticated Users should be fine on the delegation tab. Are you using any deny delegations?

3

Are your groups machine groups or user groups? Machine GPO or User GPO? If machine security group then you have to add computers to that security group. If it is a user security group then you would add users to the security group. Authenticated users includes computers so remove domain computers from your delegation tab. The only thing you want in the Security filtering is the group, or groups. Keep in mind that the object you are applying the GPO to is a group so you can link the GPO to the parent OU and it will inherit down. You must apply user GPO to users and computer GPO to computers. Make sure you aren’t targeting users with machine GPO and vice versa.

1 Spice up
4

Thank you, I think the issue is that it’s a computer GPO that I am trying to filter through user groups. The GPO is applied to the computer OU, but I am trying to filter it to a user group. Do you know how I could apply the Removable Storage Access GPOs to just certain users on all computers?

Thanks,

5

You typically can’t filter computer policies on a per-user basis. Computer settings are global as in there is only 1, either on or off it applies to the machine and all users who use it.

Why not just make a User GPO and apply the Deny USB to the group of users you want?

nousb.jpg
nousb.jpg800×520 114 KB
6

Thanks, I didn’t even think to look under the User Config for that…