GPO is both applied AND filtered out

Question

I have a GPO that is applied to MyUser's OU and filtered to MyUser. I run a gpupdate on his machine and I see that the GPO is listed under "Applied Group Policy Objects", yet it is also listed under "The following GPOs were not applied because they were filtered out" as Not Applied (unknown reason).

I've checked and it appears that the GPO is not working.

How could it be that the GPO is both applied and filtered out?

Answer 1

I was getting this error:

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
[Policy Object Name]
    Filtering:  Not Applied (Unknown Reason)

I discovered that the actual GPO was disabled on the domain controller!

Answer 2

Try this resolution

1. Delete the XML file that can be found at the following location or rename the Preferences: ..\users\All Users\Microsoft\Group Policy\History\\Preferences

2. Update the Group Policy preferences again. To do this, type the following command at a command prompt, and then press ENTER: gpupdate /force or simple restart your computer.

Answer 3

Over the years, I've seen this admittedly rare issue come up in a handful of Group Policy discussion forums. As somewhat of a Group Policy aficionado, it intrigued me, however until recently I had never had the opportunity to troubleshoot the issue directly. Last week, however, I witnessed it occur in my environment and had a chance to investigate further. I was able to resolve the issue, although I'm not precisely sure how, so I'm going to post my findings in the hopes that it helps the next person who comes across this issue.

In this instance, a single policy object exhibited this behavior, and only on one workstation. The policy in question uses GPP Drive Maps and maps network drives for all of the users in my environment, and suddenly stopped mapping them for one user. The policy had experienced no changes for at least a year, and the workstation had no changes that I am aware of for about a month. There were no other recent changes that I feel were connected to the issue.

This particular problem produces a number of symptoms. Namely:

• The policy fails to take effect: drives don't map, registry entries don't get applied, etc.
• GPResult produces contradictory output: the policy object is listed as both applied and filtered.

GPResult Output:

Applied Group Policy Objects
-----------------------------
   [Policy Object Name]

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
    [Policy Object Name]
        Filtering:  Not Applied (Unknown Reason)

• System and Application logs show no issues with policy processing. All sections report successful application. In my instance, each drive map in the policy reported that it was successful.

• Group Policy Preferences debug logging (you have to turn this on), however, shows no record of the policy whatsoever, success, error, or otherwise.
• The Operational event log in Applications and Services\Microsoft\Windows\Group Policy (you know, that part of event viewer that no one ever looks at) shows that the object is retrieved and added to the list of objects to be applied. The next event, ID 5313, should be a list of events filtered out. The policy in question does NOT appear in there.

Following these events, the operational log should list each GPP extension (drive maps, registry, files, etc.) and all of the objects that contain any policy of that class. In this case, there was simply no entry for Drive Maps, almost as if the extension didn't execute at all. My theory is that the extension itself is running into some kind of trouble. If there was an issue retrieving the objects, it wouldn't be downloaded successfully. If there was something in the object that was crashing the extension, it would be logged in the GPP debug logs. If there was a general problem with the GPP extensions, none of the others would run successfully. It's recorded in the GPResult output as applied because it's assigned to the extension to be processed, but filtered with "Unknown Reason" because the extension either never runs or crashes immediately upon running. I have the feeling that if I had had more policy objects containing drive maps, they would have failed as well, however I didn't get a chance to test this.

This issue seemed to resolve itself when I cleared the GPP Operational event log. I'm not sure if this was the actual solution, or if it was just a coincidence. If this helps anyone, please let me know.

Answer 4

We had a similar issue, with GP not being applied to a few computers (when they should be), and gpresult /R gave us a Not applied (unknown reason) response.

We didn't have a problem with the secure channel or time services. Turns out another admin had moved the IP address of a DC (and correctly updated all DHCP scope options and statically defined IPs).

The fix for our issue was simply to flush the local DNS Cache and the DNS server caches and then re-apply the GP with GPUpdate /force.

Hope this helps someone.

Answer 5

This may be very unhelpful, but will share my experience, in case it helps.

I was getting the same problem as the poster, but I was doing testing at the time:

• Parent OU - GPO x and GPO y linked
• Child OU - blocked inheritance, GPO x and GPO y linked

So when doing a gpresult, it appeared like the GPOs were both applying and not applying, but of course they were, it was just that the GPOs not applying via blocked inheritance had the same name, and confused matters.

So the moral is, check you don't have the problem GPO applying more than once (and that one of the linked GPOs is not being blocked by blocked inheritance.