Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a GPO that includes a Computer Configuration that enables a Preference that adds a security group to the local Administrators group. Since this is a Computer Configuration, do you need to add the Domain Computers security group to the Security Filtering?

The security group does not get added and GPResult is blank for the Computer Configuration section. Computers are in the correct OU that the GPO is applied/linked and there isn't any WMI filtering occuring. Any ideas?

Thanks!

UPDATE:

With a command prompt opened as Administrator I did the following:

  1. gpupdate /force
  2. gpresult /H report.html

The report shows the Computer Configuration Preference to add an AD security group to the local administrators group. Unfortunately, the group is still not added to the local admins group. Any other ideas?

share|improve this question

3 Answers 3

You will need to apply the GPO to the OU that the PC is in. Also it is a good idea to do a gpupdate /force on the computer.

share|improve this answer
    
The GPO is applied to the OU where the computer resides. Gpupdate /force has been done as well. –  user2565554 Jul 21 at 21:03
    
Are you enforcing the GPO? –  George Jul 21 at 21:09
    
The other thing that I just realized is how many domain controllers do you have? If multiple then depending on the DC that the PC is connecting you might need to wait for the GPO to replicate. –  George Jul 21 at 21:17
    
The GPO is currently using Link Enabled. We shouldn't have any competing GPO's where Enforcing this policy would be necessary. We have 5 DC's but this policy has been in place for months. I am troubleshooting why it isn't being applied to only some computers. –  user2565554 Jul 21 at 21:19
    
Make sure your DCs are properly replicating: repadmin /showrepl –  George Jul 21 at 21:21

do you need to add the Domain Computers security group to the Security Filtering?

Any AD Object you want to have access to the GPO should have security permissions to read the GPO.

share|improve this answer

May I ask a simple question: what entities are listed in Security Filtering of that GPO? By default, domain GPOs applied to "Authenticated Users" and all domain computers are count as such users. So if you need to apply GPO to all domain computers, you could leave default settings in Security Filtering.

share|improve this answer
    
Yes it has the default Authenticated Users listed in the Security Filtering section. –  user2565554 Jul 22 at 13:27
    
ok, it seems, that on this side all is fine. And what shows GPRESULT /R on target computer. You said, that computer configuration is blank, but can this computer see GPO itself in GPO list? –  Hikedaya Jul 22 at 13:39
    
Remind me how to view the list of GPO's seen by the computer? –  user2565554 Jul 22 at 14:58
    
It's easy (in elevated command promt): C:\Windows\system32>gpresult /r /scope:computer We're interested in Applied Group Policy section and "The following GPOs were not applied because they were filtered out" section. If you can't see you GPO neither first nor second section then target computer just can't read this GPO. –  Hikedaya Jul 22 at 15:17
    
Thanks. I see the GPO listed under Applied Group Policy Objects so it does see the GPO. There isn't a section showing GPOs not applied because they were filtered out. –  user2565554 Jul 22 at 16:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.