1

Hi all - apologies, I know there are several articles regarding this area, but I cant seem to relate any to my scenario.

I am currently attempting to map a network location onto specific user’s accounts through Group Policy, and using a Security Group within AD to assign the users (with the way our AD is currently set up, and considering future employees, it seems the best option to assign policies through Security Groups).

I have set up the GP, and created a group within AD, which specific users are members of.

In the Security Filtering section of GPM, I have added my Group and ensured that on the delegation tab both my group and ‘Authenticated Users’ have ‘read’ and ‘apply group policy’ checked. From what I gather, there was an update that meant Authenticated Users are now required to be there?

In this case though, it means each user in the location of the GPO (which happens to be every user in the company) is getting the network drive mapped - as opposed to just my Group of people. I’m assuming this is because authenticated users also has ‘apply group policy’ checked, but when I un-check this, the GPO doesn’t apply to anyone.

I know this can be done without having to sort my users into specific OUs on AD… I’m just struggling to make sense of my issue!

Any help would be appreciated!

Many Thanks,
Conor

1 Spice up
2

remove auth users from the security filtering. I think you are mistaking a change where you had to add domain computers as the security filter not auth users. If this causes the GPO to stop applying then your going to need to figure out why. You gpresult /v to list the GPO and security group info, it should also tell you exactly why the gpo didn’t apply. and remember your users need to log out and back in to get new security group assignments.

3

I wouldn’t bother with Security Filtering.

Use Item level targeting on the drive map GPP.

https://community.spiceworks.com/how_to/17039-mapping-drives-with-group-policy-preferences-and-item-level-targeting

2 Spice ups
4

I tried this, actually, and still no luck.

The GPO was not pulling through to any user in the group, weirdly! In this case, gpresult /v didn’t even show that it was not being applied.

@jhart

5

If you followed Rob’s steps it should work.
Does the GPO not show up at all?
Did you reboot after making the group so the user gets the group membership?

1 Spice up
6

Create a new GPO

Add Domain Computers to Delegation Tab

Add the Group to the Security Filtering of the GPO

Link it to the domain or the OU where the users exist

Set any simple User Settings

See if the GPO gets applied

7

Dont apply the GPO to Domain Computers as they have nothing to do with users. If you are removing the Authenticated users from the Security filtering and then adding your security group , make sure to add the Authenticated users to the Delegation tab of the GPO for read permissions.

1 Spice up
8

After the 2016 June update user GPO’s need to have the computer security filter as well as the user. I remember that update well…

9

The computer object needs to be able to read the GPO, not have the Apply permission. Having a read delegation for Authenticated users covers this. The Authenticated Users group is any object that authenticates with a password.

1 Spice up