1

I need some enlightment. I have a AD DC that name cisco.local. There's 20 computer that already connected to this AD DC. I've some GPO on the server and have a 'Praktikan' group. The praktikan group(security group) consist of every user start from A01-E04 (Axx,Bxx,Cxx,Dxx,Exx), and the computer CISCO-A01 - CISCO-E04 (same as the user).

The Praktikan Group Praktikan Group Member

Each of computer and user already assigned on the Praktikan user group. I set some computer GPO and assign it to the Praktikan group. The Assigned GPO to Praktikan Group

But the problem is when I do gpresult -r on each computer, non of the computer GPO shown on the gpresult -r. But on server, it show the computer applied GPO. Is there maybe I'm need to check back? The server is Windows 2016 Server, and the client is Windows 10 1709. Any help is appriciated. Thanks.

Improve this question
7
  • 1
    Are you checking gpresult -r with an elevated CMD or Powershell? Only admins can see applied computer GPOs on AD PCs.
    – Lenniey
    Sep 11, 2019 at 13:16
  • How to do that @Lenniey? I have tried to run as admin on cmd or powershell, but as soon as it elevated, it become administrator user, not the user such as C04.
    – Benyamin Limanto
    Sep 12, 2019 at 2:59
  • You just check it two times, first as USER, second as ADMIN, if the computer objects are getting applied as ADMIN, they are getting applied as USER. Btw.: if your RSOP from the server tells you all policies are applied (computer and user), they are.
    – Lenniey
    Sep 12, 2019 at 7:13
  • Okay. I did the gpresult /SCOPE computer /z and it's there and applied to the computer, but why It's not working. I mean like the auto date time and such, even it's there. @Lenniey
    – Benyamin Limanto
    Sep 18, 2019 at 6:53
  • That's a whole different question...either edit yours as it has no accepted answer yet or post a new one. What is "not working", you have to specify you problem, "not working" is not really helping us to help you.
    – Lenniey
    Sep 18, 2019 at 6:58

1 Answer 1

Reset to default
1

I would split your GPO. Having a GPO that apply user and computer settings, or target user and computer is a design error that is hard to diagnose.

As such I recommand to create a group with just user, that the GPO would target them with user settings.

and I recommand to create a group with just the computer, that the GPO would target them and apply computer settings.

Improve this answer
3
  • I've tried that but still not answering why It's not pushed to the client computer. Any Ideas?
    – Benyamin Limanto
    Sep 12, 2019 at 3:00
  • @BenyaminLimanto Computer settings not pushed, or users settings ? as any GPO, to target a group you need to add in Deleguate->Domain Computer->Read permission
    – yagmoth555 ♦
    Sep 12, 2019 at 3:08
  • Computer settings. How to deleguate. I see the Authorized User already have read permission, and my group that contain computer already have the permission. Is there anyway to debug this? I really confused with how GPO works now :o
    – Benyamin Limanto
    Sep 12, 2019 at 4:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .