All, I wasn't sure how to search for this.

It seems that many of our Windows 7 Machines are processing group policy in unpredictable ways. Here's an test example:

I created a brand new policy. I have it linked to an OU that computer A and computer B are under (along with a bunch of other computers). In the permissions on that group policy object, I've unchecked "apply group policy". I've also created a new group, and added computer A and computer B to that group. So now I GPupdate the DCs, and the clients in that order, so that everyone is up to date with the settings.

So at this point, as long as those computers are joined to the domain, they should have that policy applied to them. The GPO is enabled, it's not locked, there's no WMI filtering . . .

Now when I do a gpresult analysis from the DC on computer A, it shows that computer A has now acquired the policy. However when I do the same thing to Computer B, it has not acquired the policy.

When I remove computer A from the security group, it still sees the policy as being applied. Computer B won't see itself as applied unless I individually add that computer to the ACL list and give it the "apply group policy" setting.

Event logs on each show no policy processing errors or warnings.

Still testing other computers, but has anyone run into this before? When we used Windows XP, this sort of thing NEVER happened. GP behaved as expected every time. Sorta disappointed right now.

Any ideas?

  • 2
    RSOP.msc, gpresult /z. Your standard, go-to Group Policy troubleshooting tools. Run 'em, dig through the results, and become enlightened. – HopelessN00b May 1 '14 at 22:41
  • As a first step, eliminate your Security Filtering as the problem. It's not clear to me exactly what you've done in that respect. Remove your security group and add the Authenticated Users group. Then reboot both computers and run the Group Policy Results wizard against both of them. Look at both the applied group policies and the denied group policies. Post screenshots of both here. – joeqwerty May 1 '14 at 22:50
  • 4
    When I remove computer A from the security group, - You rebooted the system after changing the group membership right? Group memberships basically only are enumerated at logon of the computer account (OS bootup). – Zoredache May 1 '14 at 23:16
  • Thanks everyone for your responses. @Zoredache, Thanks for reminding me about that and yes, I can imagine that would have an impact. They're occupied machines, so as soon the users for those machines reboot, we'll see. They had rebooted previously but there were some other settings that may have interfered. – user1197457 May 2 '14 at 14:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.