1

I have two OUs both filled with computers & users. One OU won’t apply any of the GPO settings to the computers.

The modeling of one of the computers says all the GPOs were applied as I’d expect. It also mentions a fast link is detected, if that matters. The gpresult /r on the aforementioned computers says Applied is N/A, Filtering is “Local Group Policy Not applied (empty)”, then lists all the security groups which seem to show everything.

I read this thread–and the linked telnet thread–and I think I’ve gone through all of this GPO not applying

The security filtering is just Authenticated Users, but the OU has computers, users, and security groups and not just security groups by themselves.

I don’t have any WMI filters.

Permissions are set to read.

4 Spice ups
2

" Permissions are set to read." exactly what permissions? Do you mean the delegation tab has read for Authenticated users?

Is this one specific GPO or do you mean all GPOs are failing in that OU?

Move one PC to a different OU, then restart it and test if GPOs apply - if so it is definitely the OU.
Modelling says they should apply so it is not inheritance issues.
Does the default domain policy not apply?

1 Spice up
3

Have you run gpresult /h yet? I find those tend to be a bit clearer than /r for this kind of troubleshooting. Are all machines that are meant to be affected listed in both the Delegation and Security tabs for the second OU? Are all GPOs shown as linked to this OU?

1 Spice up
4

Go to a computer/user in that OU. Have them reboot their computer and re-login. Then open up Event Viewer and read the Group Policy logs (Application and Service Logs\Microsoft\Windows\Group Policy). There is a ton of detail in there. Oftentimes you’ll get a great hint about what is going on.

2 Spice ups
5

Yes, the delegation tab has at least read for the Authenticated users, domain users, etc.

All GPOs in this OU are failing.

I moved a computer to another GPO…and it grabbed the policies. Back to the original OU and it didn’t grab anything. Of note, I noticed a previous inheritance policy isn’t getting applied either, but Ill talk that later.

6

Good tip.

Get one message that 0 user policies were applied, and another message that 8 for the computer were applied. I have a loopback policy, so this seems about right.

And of course, no policies being applied according to results. :slight_smile:

7

If I remember correctly (it’s been 10 years), it will tell you what GPOs are in the domain, and what GPOs were applied, including permissions or reasons why a particular GPO was not applied. You might have to make a regedit to increase logging “sensitivity”, but the GPO logs are great for sussing out permission issues.

1 Spice up
8

So I figured it out, but not the direction I thought this was going.

I didn’t know I could drill down to specifically GPO stuff in the Event Viewer, so that was cool.

…But I couldnt view things because I didnt have administrative privileges, which was one of the GPO policies I was attempting to apply. Curiously, I claimed to never see any policies apply because they were all computer based, and gpresult /r were only showing User policies and I never noticed the computer policies weren’t listed at all. Only when I logged in as local admin and did a gpresult /r – because I was trying to see the Event Viewer as Admin (and running as admin wouldnt work)-- did I see the computer policies were infact applying.

Ultimately, my GPO that gave local administrator was not configured correctly. Once I made the change and rolled it out, the gpresult /r showed computer policies on the workstation accounts and everything is working as intended.

This only took about 3 months, yet Spiceworks helped me solve another.