0

I have two machines who just joined the domain. These two machines will be logging in as the guest account. The guest account was enabled on AD. I moved this user to its own OU and applied a GP that i created for it. However, for some reason, the gp does not apply. I try to do gpupdate /force (non admin mode) and i get a User settings were updated successfully but the computer was not, However the gpo doesnt seem to apply since the changes do not take effect. When i try gpresult (admin mode). The computer settings apply but the user fails saying that there was an error attempting to get the policies.

To verify in non admin mode i ran gpresult /r and i got error: username or password incorrect in admin mode gpresult /r /user guest (or domain\guest) and i get an error that there is no Rsop data for the user guest.

I've spent over 72 hours trying to figure this out, tried many articles found using google but i have had no luck. I have two DCs (one is Server business 2011, one is Windows server 2016, or 19 i can't remember lol).

  • I can ping both servers with their name, DNS settings are correct pointing on the DC (dc is the dns server)
  • nslookup returns the right resolution.
  • Dcdiag doesnt show any problems.
  • I can access sysvol without a problem.
  • i can access both servers UNC paths.
  • GP has the guest account in the users delegation section with read permissions

One thing i noticed is that when i login under a domain user (not the guest), the policy seems to apply, gpresult /r says that the policy has applied.

Any one has any suggestions for a fix?

Edit: I use guest due to.. read comments below.

Improve this question
5
  • 1
    Why use guest? Why not a named user?
    – Semicolon
    Feb 22, 2021 at 22:25
  • MS doco says the Guest account shouldn't be moved out of the Users container. I wonder if it's not creating a local profile, so group policy won't take effect. Also, why a guest account? For logging on with no pword? Also, if it's the Guest account that is not a member of Domain Guests, it won't get the Authenticated Users SID. I agree about using a named account and following guides for setting up a "kiosk", if that's what you want.
    – LeeM
    Feb 23, 2021 at 9:17
  • I use guest because profile needs to be deleted after they log off. its a shared pc that cannot save any user data. Guest account is a domain user member. I cant use kiosk because they need access to multiple programs and be able to download temp files if needed by the user.
    – nando
    Feb 23, 2021 at 13:30
  • I moved the guest account back to the users container and moved the GP to the domain root level but no luck. It still doesn't seem to apply. i get "User Policy could not be updated successfully. The following errors were encountered: The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. "
    – nando
    Feb 23, 2021 at 13:40
  • Soo.. i think i found a solution for my case. I am testing it right now and will report if it works. I will create a normal user and add that users to domain guests group and remove that user from domain users group. It seems to be removing the local profile at logout, thus so far so good. Ill let you guys know.
    – nando
    Feb 23, 2021 at 14:05

1 Answer 1

Reset to default
0

Solution

Don't use the builtin guest account on AD. This will cause many unnecessary problems.

Create a new user and add that user to the domain guests and guests group (guests group may not be needed, but i added it anyways).

Remove the new created user from the Domain Users group.

Add the new user to the delegation list with read permissions and make sure you add the GPO to the right OU Container (the one where the user will be in).

Now if you want the user account to not have a password.. use the following powershell command on a DC

Be careful with this command. In my environment, the new user has no access to any domain resources other than a shared printer and some GP settings that were applied to lock a few things.

Get-ADUser -Identity [new guest username] | Set-ADUser -PasswordNotRequired $true

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.