1

I created a GPO to Replace a desktop shortcut.

  • applied the GPO to Test OU with Security filter by adding a $security Group

Test OU has got 5 PC and I have added 2 PCs to $Security Group.

Policy worked as expected (replaced the current shortcuts with new link)

Problem:

When I Link the GPO to Workstation OU which is the Parent OU and then added the certain PC from different department to the Security Group created above.

Policy not applied - GPO Access Denied(Security Filtering) - Check the delegate tab all look fine

e.g OU Structure below

Workstation OU(Parent OU)

Dept 1 OU (Sub OUs)

Dept 2 OU (Sub OUs)

Dept3 OU (Sub OUs)

Test OU (Sub OUs)

Requires all you valuable inputs

8 Spice ups
2

Did you reboot the machines? Were they in contact with the DC when they were rebooted?

Group membership is applied on boot for PCs. Sounds like they aren’t a member of your security group yet.

3

what permissions does ‘authenticated users’ have.
I had similar experience when I denied/unticked ‘read’ instead of just unticking ‘apply’

1 Spice up
4

Authenticated Users is a special identity that includes anything that logs in with a password. It covers User Objects and Computer Objects.
So if you deny authenticated users the GPO will apply to no objects.

5

Thanks Guys,

  1. PC rebooted several times
  2. Authenticated Users - Read , apply GPO un-ticked .[as aplying the policy to security Group]

hope this helps. Everything in right place but its not getting applied

6

Check this article:

Policy settings incorrectly applied or denied due to security filtering:

Also, check below earlier discussed threads:

GPO doesn’t apply due to error Access denied (security filtering)

GPO isn’t applying: Access Denied (Security Filtering)

Hope this helps!

7

Thanks Rupesh, I have gone through those artical. All my setting are right in place.

Latest output.

When I run the Group policy Results Wizard on the GPMC - it says the policy is applied successfully

But the actual machine is not updating the policy

Regards

8

Thanks All Issue Resolved. We have GPO link precedence which was causing the issue. I have enforce the new policy which did the trick.

Regards
Prabhu

1 Spice up