We have a GPO that includes a Computer Configuration that enables a Preference that adds a security group to the local Administrators group. Since this is a Computer Configuration, do you need to add the Domain Computers security group to the Security Filtering?

The security group does not get added and GPResult is blank for the Computer Configuration section. Computers are in the correct OU that the GPO is applied/linked and there isn't any WMI filtering occuring. Any ideas?



With a command prompt opened as Administrator I did the following:

  1. gpupdate /force
  2. gpresult /H report.html

The report shows the Computer Configuration Preference to add an AD security group to the local administrators group. Unfortunately, the group is still not added to the local admins group. Any other ideas?

  • Some computer settings only apply when the affected computers are rebooted. This may be one of them. That is the next thing I would try, if it hasn't already been tried. Note that some user settings only apply when the user logs on (i.e., are still not applied after a gpupdate). Computers only log on when they boot (AFAIK), so this is the equivalent limitation to the user caveat. Dec 18 '17 at 15:24

You will need to apply the GPO to the OU that the PC is in. Also it is a good idea to do a gpupdate /force on the computer.

  • The GPO is applied to the OU where the computer resides. Gpupdate /force has been done as well. Jul 21 '14 at 21:03
  • Are you enforcing the GPO?
    – George
    Jul 21 '14 at 21:09
  • The other thing that I just realized is how many domain controllers do you have? If multiple then depending on the DC that the PC is connecting you might need to wait for the GPO to replicate.
    – George
    Jul 21 '14 at 21:17
  • The GPO is currently using Link Enabled. We shouldn't have any competing GPO's where Enforcing this policy would be necessary. We have 5 DC's but this policy has been in place for months. I am troubleshooting why it isn't being applied to only some computers. Jul 21 '14 at 21:19
  • Make sure your DCs are properly replicating: repadmin /showrepl
    – George
    Jul 21 '14 at 21:21

do you need to add the Domain Computers security group to the Security Filtering?

Any AD Object you want to have access to the GPO should have security permissions to read the GPO.


May I ask a simple question: what entities are listed in Security Filtering of that GPO? By default, domain GPOs applied to "Authenticated Users" and all domain computers are count as such users. So if you need to apply GPO to all domain computers, you could leave default settings in Security Filtering.

  • Yes it has the default Authenticated Users listed in the Security Filtering section. Jul 22 '14 at 13:27
  • ok, it seems, that on this side all is fine. And what shows GPRESULT /R on target computer. You said, that computer configuration is blank, but can this computer see GPO itself in GPO list?
    – Hikedaya
    Jul 22 '14 at 13:39
  • Remind me how to view the list of GPO's seen by the computer? Jul 22 '14 at 14:58
  • It's easy (in elevated command promt): C:\Windows\system32>gpresult /r /scope:computer We're interested in Applied Group Policy section and "The following GPOs were not applied because they were filtered out" section. If you can't see you GPO neither first nor second section then target computer just can't read this GPO.
    – Hikedaya
    Jul 22 '14 at 15:17
  • Thanks. I see the GPO listed under Applied Group Policy Objects so it does see the GPO. There isn't a section showing GPOs not applied because they were filtered out. Jul 22 '14 at 16:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.