So I've created a few VM's and thought I'd have a go at trying to apply a few group policies to try and get my head around it.

Put simply, all I want to do is to apply a GPO for a desktop background.

Take these shots:

I've created the OU User Polocies within ADUC and created a security group (Background Settings) with two users (Joe Doe & Taylor James) within that OU.

enter image description here

I've created a few GPO's and linked them to the OU (via GPmgmt) and added the security group (Background Settings) under "security Filtering" with GPmgmt

enter image description here

For some reason though this will not work, I've restarted the VM's and logged in/out countless times. I've even tried gpupdate /force via CMD but to no avail.

Any ideas?

  • As an aside... the /force option is only useful when you suspect the underlying settings applied by group policy might have changed by other means. It will apply the setting regardless of whether a GPO has been changed (GPOs have version numbers). – john Nov 2 '12 at 19:14

You can't apply a GPO to a group like you're trying to do. You would need to apply it to an OU that contains users or computers. In this specific case, you'll need to apply it to an OU that contains users.

Security filtering is not necessary unless you have other users in that OU that you don't want it to apply to.


Are the GPO settings User or Computer settings? If they're User settings then have you moved those user accounts into the User Policies OU? If not, you need to OR you can configure Loopback Policy processing in Merge or Replace mode in those GPO's.

GPO settings apply to objects in their path (SOM - Scope of Management). Objects not in the path of the GPO do not have those GPO's applied. For GPO settings from the GPO's linked to the User Policies OU to apply to users you need to have the user accounts in the path of those GPO's, meaning they need to be in that OU. The group filtering you're doing does just that; it filters the GPO so that it is only applied to members of that group whose user accounts are in the GPO path.

Alternately, if you have computer accounts in that OU and you only want those GPO's applied to users when they log on to those computers then you need to configure Loopback Policy processing in those GPO's, which then tells the GPO CSE (client side extension) to apply the user settings from those GPO's in addition to or in replacement of (Merge or Replace) the users normal GPO settings.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.