0

I am trying to apply several policies to my domain (running on Windows 2008 R2).

Below is a sample of how I have structured my OUs.

Test OU

  • {Computer based policy}
  • {User Based Policy}

    OU Users

    OU Computers

Should the policies take affect even at the level I have applied them?

I have one policy that effects Users and the other effects Computers. When I run GPResults it shows several policies not taking effect because they appear "Empty". Do I need to apply the policy at the User/Computer level or should I be placing it at the Test OU level work accordingly?

2
  • 2
    An Empty GPO has no settings configured. Do you have settings configured in these GPO's?
    – joeqwerty
    Sep 12, 2014 at 14:25
  • Do you have multiple DCs? Are you sure your sysvol replication is working?
    – Zoredache
    Sep 12, 2014 at 16:45

3 Answers 3

1

It should be noted that computer and user accounts can only "see" their respective portion of a group policy object. In other words, when a user account logs on, if it processes a GPO that only contains computer settings, that GPO it will appear to be "empty" to the user account because it did not contain any settings that the user account could see.

Unless GPResult is showing or not showing a policy setting it should/shouldn't be, then you can ignore errors about the GPO being empty.

0

Simply put, when you apply a policy, you must link it to a Group Policy OU. So, populate your OU Users & Computers, apply the policy to the OU/link. (Usually at a domain level) and then go to a test machine and run:

gpupdate /force

This forces the computer to re-sync with Group Policy in order to get the policies its OU has been assigned. You also have to make sure that your link order is correct. This can be achieved by going to:

Group Policy Management (Administrator enabled) -> yourdomain.ext (Under Forest > Domains) -> Linked Group Policy Objects

Set the correct order and enforce if need be, but be careful with enforcing as it overrides a lot in GP.

P.S. Also make sure that you actually have a setting in the policy assigned. i.e. Block Control panel = Enabled, because Empty refers to nothing being there in the first place.

0

Run GPRESULT /H gpresult.html and see what policies are being applied. See the status of each policy and see if it's being applied successfully or not.

Then check the revisions of the GPO's. The AD Revision and the Sysvol Revision should be identical.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .