1

Hi all. I am hoping someone can point me to some documentation that explains this behavior. I have 2 policies linked at the domain level with conflicting settings, but the behavior is not as expected. My understanding is that Policy settings typically overwrite Preference settings, especially when the policy settings are enforced, but that is not happening here. #2 applies Preference registry settings that are contradicted by #1 which applies those same settings (but different values) via Admin Templates. Policy 2’s Preference settings are reflected in the server’s registry. GP Inheritance seems fine, #2 is ranked 25 while #1 is ranked 6.

.

Policies explained below:

  • Policy 1 - Enforced - Computer Config - HKLM\Admin Templates\Printers setting
  • Policy 2 - Not Enforced - Computer Config - HKLM\Preferences\Registry\Registry Items (Replace mode)

.

Why would an unenforced policy with preferences settings have precedence over an enforced policy with policies?

6 Spice ups
2

Let’s take a step back for a moment. Why do you have conflicting GPO’s in place to begin with? What is the purpose for both of these?

3

I am fixing misconfigurations and need to explain why it works the way it does to management before making changes. Also for my general knowledge regarding how GPO processing works.

4

Policy #1

3b20a305-57bd-4d23-b6ae-cf7a43276776-1.JPG
3b20a305-57bd-4d23-b6ae-cf7a43276776-1.JPG800×340 38.2 KB

Policy #2

65771e7d-244a-45f4-adeb-26e930963080-2.JPG
65771e7d-244a-45f4-adeb-26e930963080-2.JPG800×618 62.8 KB
a3553bef-70d0-4536-b8eb-d440e23e9181-3.JPG
a3553bef-70d0-4536-b8eb-d440e23e9181-3.JPG800×319 30.3 KB

7f663b15-f9b7-42ec-9014-f934bbd29a22-4.JPG
7f663b15-f9b7-42ec-9014-f934bbd29a22-4.JPG800×137 20.6 KB
5

If the GPO’s are applied at the top level of your domain(if I understand you correctly), select your domain name in group policy management then on the right, select the group policy inheritance tab. Which GPO is higher in the precedence? Also, do you know if delegation has been modified? You confirm the enforced gpo is applied in any way by opening up an elevated cmd prompt and run “gpresult /r /scope computer”. You can also run “RSOP /scope computer” to see if you find any settings from the enforced policy being applied**.**

Also, FYI, policies typically override preferences so I interpret that as not always.

1 Spice up
6

Hi jrp, thanks for the assistance. GP Inheritance seems fine, #2 is ranked 25 while #1 is ranked 6. The GPresult shows both GPOs as winning. I am aware of the typical statement microsoft makes, but I have not been able to find specific exclusions to the typical behavior.

7

Change the second policy from Replace to Update then do a gpupdate /force on a machine. I’m curious what happens.

8

I was curious about that too. Maybe the delete and create caused this issue. Ill try to do some testing today. I am trying to build a 2003 VM to test since it should have more in depth logging via Userenv.log (and 2003 is one of the VMs affected).

1 Spice up
9

That is my thought as well. I rarely see Replace being used.

10

@jayparker9836 ​

Sorry for the delay in testing. Log4j has been causing me headaches and I have not been able to complete my testing scenarios.

1 Spice up