1

So I decided I wanted to create a testing OU to apply policies that I want to test out before I push them live. The OU is 1 level down from the domain. Inheritance is not blocked. But for some reason I cannot get the policies linked to this OU to apply to the users in the OU. They are user policies, essentially just a login script.

The domain level policies are applied just fine. The only policies that are not getting applied are the ones from the testing OU

Any help would be awesome.

3 Spice ups
2

Edit: I re-read and saw users. Nevermind.

Make sure you are NOT making the GPO edits in the Computer Configuration settings, and are using User Configuration settings.

Also, run RSOP.

3

Did you run RSOP to see what the results are when you do a gpupdate /force? Also the user you are logged in as is in the OU that you are applying the policy to? And FYI logon scripts have a difficult time applying if the computer logs in before the network kicks in (some laptops do this where 802.1x auth is involved).

2 Spice ups
4

Are these user settings or computer settings?

2 Spice ups
5

Did you check the delegation? I have had to add users to this to make things work in the past.

6

Do you have user settings disabled, and are the users a member of the group that the group policy is associated with?

7

Check security filtering to make sure it would apply to the users in the OU.

Is the link Enforced and Enabled for the OU?

What exactly is the script supposed to do?

8

Hi all.

I have 2 policies linked to this OU, neither of them have computer edits. I did run RSOP, neither policy under the testing OU is being applied.

My testing user is in the Testing OU, but the computer I am logging in from is not.

Authenticated users have apply perms to both policies. Nothing is set to deny.

9

In the RSOP results, do you see your 2 GPOs listed under User Configuration\Denied GPOs? If so, is there a Deny Reason listed there?

Darren

10

RSOP does not show anything being denied. Unfortunately, the event log has no errors either.

11

Joe-

If that’s the case, then something is wrong with your targeting. If RSOP shows nothing about those two GPOs, then the user is not even evaluating them. Is there a chance that the computer you’re logging into is set to loopback-replace mode? That would explain this behavior, short of AD replication issues.

Darren

12

Hey Darren, thanks for the idea! As it turns out one of my GPOs that were linked but not enforced in the domain root had loopback processing enabled. I didn’t think it would do anything since it was not enforced. Apparently I was wrong. The moment I removed the setting and did an update on the client machine it was working.

13

HAve you tried forcing the GPO?

14

Helpful post here: