I am trying to enable certificate autoenrollment and credential roaming through a GPO in an ADS domain (DCs are Windows Server 2008 R2). I can interactively log on as a newly created user (on a member server, Windows Server 2012), and the policy is applied to that user. However, when an identically created new user logs on as a service identity, the GPO is not applied, as I can confirm by inspecting its registry, which is loaded under under HKU\<SID> while the service is running.

I begin to suspect that GPOs are not applied to service logons by design, but I cannot confirm or deny that. Is this true, and if not, how can I diagnose why the GPO is not applied to the service identity user?

  • I quite certain that GPOs don't apply to non-interactive logons (and you can change this directly), but couldn't find any reference on the internet. Anyway, why don't you apply your policy on the computer instead? Alternatively, maybe you can run a script to configure what you need before running the service itself. – EliadTech Apr 2 '15 at 8:26
  • @EliadTech: The problem is that I need to enable 2 policies that apply to users. First, enable autoenrollment (these differ for user/computer, as either type of object may have a certificate). This has to be done on a handful of accounts, and doableby hand. The second problem is worse though: credential roaming is enabled per user, but we do not know where that user will log on, as we are expanding the farm and swapping servers. The service can run on any computer in the farm, and all instances must have access to the same private key. That'd be a bummer if that worked only for theinteractive! – kkm Apr 2 '15 at 17:16

Yes, it's true.

The specification for the User Policy Settings indicates that

The User Policy Settings specify capabilities and behaviors for interactively logged-on users.

If you are not logged on interactively, you are out of scope.


When the Group Policies are refreshed periodically by the Periodic Refresh timer the documentation says:

This timer is triggered periodically to check for an updated policy for the computer or for each user who is interactively logged on to the computer[...]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.