All, I wasn't sure how to search for this.
It seems that many of our Windows 7 Machines are processing group policy in unpredictable ways. Here's an test example:
I created a brand new policy. I have it linked to an OU that computer A and computer B are under (along with a bunch of other computers). In the permissions on that group policy object, I've unchecked "apply group policy". I've also created a new group, and added computer A and computer B to that group. So now I GPupdate the DCs, and the clients in that order, so that everyone is up to date with the settings.
So at this point, as long as those computers are joined to the domain, they should have that policy applied to them. The GPO is enabled, it's not locked, there's no WMI filtering . . .
Now when I do a gpresult analysis from the DC on computer A, it shows that computer A has now acquired the policy. However when I do the same thing to Computer B, it has not acquired the policy.
When I remove computer A from the security group, it still sees the policy as being applied. Computer B won't see itself as applied unless I individually add that computer to the ACL list and give it the "apply group policy" setting.
Event logs on each show no policy processing errors or warnings.
Still testing other computers, but has anyone run into this before? When we used Windows XP, this sort of thing NEVER happened. GP behaved as expected every time. Sorta disappointed right now.
Any ideas?
RSOP.msc
,gpresult /z
. Your standard, go-to Group Policy troubleshooting tools. Run 'em, dig through the results, and become enlightened.Authenticated Users
group. Then reboot both computers and run the Group Policy Results wizard against both of them. Look at both the applied group policies and the denied group policies. Post screenshots of both here.When I remove computer A from the security group,
- You rebooted the system after changing the group membership right? Group memberships basically only are enumerated at logon of the computer account (OS bootup).