So today, I'm going through and cleaning up/consolidating our GPOs and moved a couple from a second-level OU to the domain level. These (user) policies are used to block/allow access to the command prompt. By default, all users are blocked from using the command prompt. Users can then be added to a security group that has permission to run the second (higher precedence) GPO to turn it back on.
When the GPOs are in the second level, they work as expected. But once I move them to domain level, all users are blocked from using the command prompt, to include the onces that should have access.
Our GPOs are well segregated, and I verified there were no conflicting GPOs. Link order and policy inheritance precedence was verified. Group Policy results showed both policies applying on the appropriate users, yet command prompt access is still blocked. Moved the GPOs back down... and everything works again?
What gives? Is there something special at the domain level that would cause this behavior?