1

Hi All,

After a business application upgrade, I found that a policy that was supposed to be applying to a “Laptops” OU, wasn’t actually applying.

The only way I could get the policy to apply was by applying it at the root of the domain.

The weird thing is when linked with the Laptops OU and a gpresult /r was issued, the policy wasn’t applying nor was it filtered out, it just wasn’t listed at all.

I have done GP Model and it should be applying.

There are no blocks to inheritance at all.

I’m puzzled

4 Spice ups
2

Are using security filtering?

Check this out

To resolve this issue, use the Group Policy Management Console (GPMC.MSC) and follow one of the following steps:

Add the Authenticated Users group with Read Permissions on the Group Policy Object (GPO).

If you are using security filtering, add the Domain Computers group with read permission.

Here is a Technet blog post about it: https://blogs.technet.microsoft.com/askpfeplat/2016/07/05/who-broke-my-user-gpos/

3

If the OU that that laptop is in has blocked inheritance (depicted by a blue icon over the OU), then you can do one of three things:

  1. Move the laptop to another OU that doesn’t have blocked inheritance.
  2. Right click and select Blocked Inheritance to remove it (by unchecking it). Do a gpupdate /force Run command and reboot.
  3. Right click that GPO and select “Enforced”. Because Enforced overrides Blocked Inheritance.
4

Another thing to look at is if they are User configurations or Computer configurations. User needs linked to User OU’s and Computer needs linked to Computer OU’s

5

Check and make sure that the laptop is actually in that ‘Laptops’ OU. Or in a child OU. Just in case :slight_smile: