1

Good morning fellow spiceheads

It has been a while since i have had to work on Group Policies but as far as I can tell I am doing everything correctly yet not a single GPO I have created is being applied to a single PC on the network. This is a brand new 2019 Server and all PCs on the network have been joined to the domain.
I have created several GPOs at this point. A GPO for Updating, Network Printers, and Mapped Drives. All GPOs created are linked to OU and the scope started with Authenticated Users which should work. I then added domain users to the scope and attempted to force update the group policies but they still aren’t showing on the PC side. The only thing showing is the default domain policy which is only using the authenticated user group and being applied without issue. Not sure what i am missing but it all looks like it should be working. Anyone have any thoughts or suggestions?
Regards
Todd

7 Spice ups
2

Do the user objects live within the OU the policy is applied to? This is a 2019 domain controller correct? Are there any other domain controllers in your environment?

3

Yes they do reside within the OU. The server is 2019 latest build and all updates and there are no other domains

4

That isn’t what I asked. Is the server 2019 a domain controller and are there any other domain controllers in your enviroment?

5

You are correct, I apologize. Yes this 2019 Server is the DC and there are no other DCs on this network

6

You have done a GPUDATE /FORCE on these workstations and I am also assuming that they have been restarted? Can you post any of the policy settings?

Have you run GPRESULT on the users the policy is applied to?

7

Yes I have a run a force update on the PCs and from the server end as well as restarted the computers. The only group policy showing as applied is the default policy.

GPMC__3.png
GPMC__3.png800×418 115 KB
GPMC__1.png
GPMC__2.png
GPMC__2.png671×728 13.6 KB
8

Without posting 50 screenshots, the gpresult shows for computer configurationt he default policy being applied and also the status of the GPOs in question all show as enabled. I did attempt to enforce but they still weren’t being applied

9

They are for users

@spiceuser-n1loi

10

First thing is first, your OU structure is wrong. Leave DC alone and create separate OU for users and link the policy to the new user OU and move all users in it. Right now it’s not gonna work.

I also noticed your domain ending with .local. It’s not a good idea for newly created domains. It should be your FQDN such as ad.yourdomain.com

11

Your scope only shows this being applied to domain controllers OU

2 Spice ups
12

oh man! I feel like a clown now. Ok I will correct and force push. I am assuming that will resolve my issue. I will give update here shortly. Thanks Rockn

@rockn

13

Yup that fixed it! Thank you so much Rockn! I been working on this project all weekend long and think I am just really tired. Thanks again for all your help

@rockn

1 Spice up
14

Late to the party but you should make some OUs. You can’t link GPOs to the default containers. (Users/Computers)
Move the objects out of their default containers.
At least make a company computers OU and a company Users OU. Maybe a company servers OU. At least some basic organization that helps manage objects in the domain.
I would also use redircmp to change the default machine join OU to your new machine OU.
Also your drive map is a User Configuration, you would want to link that to your OU co raining User objects. Linking a lot of GPOs to the domain root can cause issues down the road.

1 Spice up
15

Thanks for the suggestions. I was actually tasked with this after a server tech left our company several months ago. I am mostly desktop support and networking technician so I was handling this GPO task as a rookie. I will have to educate myself more on this. Thanks again for your insight and suggestions

@jhart