1

We have a GPO that includes a Computer Configuration that enables a Preference that adds a security group to the local Administrators group. Since this is a Computer Configuration, do you need to add the Domain Computers security group to the Security Filtering?

The security group does not get added and GPResult is blank for the Computer Configuration section. Computers are in the correct OU that the GPO is applied/linked and there isn't any WMI filtering occuring. Any ideas?

Thanks!

UPDATE:

With a command prompt opened as Administrator I did the following:

  1. gpupdate /force
  2. gpresult /H report.html

The report shows the Computer Configuration Preference to add an AD security group to the local administrators group. Unfortunately, the group is still not added to the local admins group. Any other ideas?

Improve this question
1
  • Some computer settings only apply when the affected computers are rebooted. This may be one of them. That is the next thing I would try, if it hasn't already been tried. Note that some user settings only apply when the user logs on (i.e., are still not applied after a gpupdate). Computers only log on when they boot (AFAIK), so this is the equivalent limitation to the user caveat.
    – Todd Wilcox
    Dec 18, 2017 at 15:24

3 Answers 3

Reset to default
0

You will need to apply the GPO to the OU that the PC is in. Also it is a good idea to do a gpupdate /force on the computer.

Improve this answer
8
  • The GPO is applied to the OU where the computer resides. Gpupdate /force has been done as well.
    – user2565554
    Jul 21, 2014 at 21:03
  • Are you enforcing the GPO?
    – George
    Jul 21, 2014 at 21:09
  • The other thing that I just realized is how many domain controllers do you have? If multiple then depending on the DC that the PC is connecting you might need to wait for the GPO to replicate.
    – George
    Jul 21, 2014 at 21:17
  • The GPO is currently using Link Enabled. We shouldn't have any competing GPO's where Enforcing this policy would be necessary. We have 5 DC's but this policy has been in place for months. I am troubleshooting why it isn't being applied to only some computers.
    – user2565554
    Jul 21, 2014 at 21:19
  • Make sure your DCs are properly replicating: repadmin /showrepl
    – George
    Jul 21, 2014 at 21:21
0

do you need to add the Domain Computers security group to the Security Filtering?

Any AD Object you want to have access to the GPO should have security permissions to read the GPO.

Improve this answer
0

May I ask a simple question: what entities are listed in Security Filtering of that GPO? By default, domain GPOs applied to "Authenticated Users" and all domain computers are count as such users. So if you need to apply GPO to all domain computers, you could leave default settings in Security Filtering.

Improve this answer
9
  • Yes it has the default Authenticated Users listed in the Security Filtering section.
    – user2565554
    Jul 22, 2014 at 13:27
  • ok, it seems, that on this side all is fine. And what shows GPRESULT /R on target computer. You said, that computer configuration is blank, but can this computer see GPO itself in GPO list?
    – Hikedaya
    Jul 22, 2014 at 13:39
  • Remind me how to view the list of GPO's seen by the computer?
    – user2565554
    Jul 22, 2014 at 14:58
  • It's easy (in elevated command promt): C:\Windows\system32>gpresult /r /scope:computer We're interested in Applied Group Policy section and "The following GPOs were not applied because they were filtered out" section. If you can't see you GPO neither first nor second section then target computer just can't read this GPO.
    – Hikedaya
    Jul 22, 2014 at 15:17
  • Thanks. I see the GPO listed under Applied Group Policy Objects so it does see the GPO. There isn't a section showing GPOs not applied because they were filtered out.
    – user2565554
    Jul 22, 2014 at 16:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .