1

Hello, looking for some advice…

I’ve recently started in fairly basic AD environment and looking to start using groups for mapping drives.
Most of the GPOs that were previously created do not use groups, they are applied to Authenticated Users and have no issues whatsoever. I’ve even created some new drive mappings and applied to auth users and yep, all good…

The problem I’m having is with specifing a group to map a drive. I’ve added the group into security filtering, checked delegation and added Authenticated users to read only and also checked the group that I specified in delegation and yep, has read and apply gpo checked.

After trying multiple different things, I CAN get it to map however I have to run gpupdate /force as admin. This makes me think it’s related to permissions somehow. If I run gpupdate as the standard user, it will not work. Get the security filtering denied under gpresult.

Anyone had something similar, or can share any tips? Not sure what to try next.

1 Spice up
2

well first use item level targeting for the drive mapping. So this means the GPO itself can apply to all users but the setting is targeted to a security group. If you use the ‘remove when no longer applied’ option also it will unmap if a user is removed from the group.

However specific to your current error I also suspect permisions.
Did you reboot and logon to test?
running gpupdate as admin makes no sense as that will use as the admin user not the user in the security group. unless the admin is part of that group.

Use the group policy modeller to see what it says (specify the computer and user). Also use gpresult to determine if it thinks it applied the GPO.

1 Spice up
3

Depending upon how old the AD/GP environment is, there was a shake-up a while back that upended how basic permissions were required for GPOs to apply correctly.

Here’s a link that may explain what’s happening to you and how to resolve it. (specifically; this part)