Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a problem with my domain, were the group policies aren't applying.

I currently have two security groups; 1) 32bit clients 2) 64 bit clients In these two groups are our different computers, running 32bit and 64bit Windows 7.

In the GPMC I have made two policies that affect both the user’s desktop and computer settings. Now all I want to do is set it so the 32bit group get the 32bit policy, and the 64bit computers get the 64bit policy, but it isn't working.

Following various guides online to set up security filtering, I linked the GPO to the domain, went into the delegation tab, opened the ACL, unticked apply for Authenticated Users, added the 32 or 64 group, then clicked read and apply for them. I then went back to the client (in this case a 64bit PC), and once gpupdate /force had been completed, I ran a gpresult and it says that the GPO hasn’t been applied due to "Access Denied (Security Filtering)".

This has baffled me, as I've checked the PC is in the 64bit group, checked the read and apply settings but no luck. I've tried adding and removing Authenticated Users from the Security Filtering tab, but with no luck.

It's annoying me because this should be so simple!

Any help would be greatly appreciated.

Jake

Setup: Windows Server 2008

share|improve this question
    
Are both policies denied? Computer & User? –  MichelZ May 23 '12 at 18:37
    
Did you place the the users in the correct OU? –  user122160 May 23 '12 at 22:10
add comment

3 Answers 3

up vote 2 down vote accepted

The message "Access Denied (Security Filtering)" usually means that the computer settings were not applied due to gpupdate was not run from an elevated command prompt.

Also, I would use a wmi filter, so you don't need to manage groups. Another limitation with groups is the group membership does not take effect until a computer is restarted.

Windows 7 x64:
SELECT * FROM Win32_OperatingSystem WHERE Version LIKE "6.1%" AND ProductType="1" AND OSArchitecture = "64-bit"

Windows 7 x86:
SELECT * FROM Win32_OperatingSystem WHERE Version LIKE "6.1%" AND ProductType="1" AND NOT OSArchitecture = "64-bit"

More information:

Create WMI Filters for the GPO
http://technet.microsoft.com/en-us/library/cc947846%28WS.10%29.aspx

share|improve this answer
add comment

If the computers have been recently added to these security groups, then they need a reboot.

They won't have their new group memberships in their token until they get a new one, which is about a week by default (or until a reboot).

share|improve this answer
add comment

I ran into the same issue and found that because I had linked the GPO I had to select the shortcut of the GPO the choose Delegation in the right Pane. Choose Advanced, Authenticated Users and check "Apply Group policy" as it already had read.

I then went back to the server and ran (From elevated command prompt) gpudate /force.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.