2

One of our vendors is requesting that we provide Skype access, which uses specific ports and IPs. In order to facilitate the access, we need to deploy a set of Windows firewall rules. The target clients are spread across different OUs and therefore cannot be applied based on OU. Instead, I created a group with the users' machines. The problem is that the GPO doesn't apply to the machines. I've tried a gpupdate /force and a reboot, but the policies don't apply.

The interesting thing is that if I add the computers individually, the computers will get the GPO. It only appears to be the computer group that will not take the GPO.

The settings for the GPO are:

The GPO is applied at the toplevel of the domain and relies on security filtering.

My security settings are currently set to:

Read Allow Apply Group Policy Allow

enter image description here

Links:

Enforced No Link Enabled Yes

enter image description here

Security Filtering lists only my group. I removed authenticated users.

GPResults

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
Firewall Exception for Java for Ecommerce PCs
    Filtering:  Not Applied (Unknown Reason)

Firewall Exception - Skype for Business
    Filtering:  Not Applied (Unknown Reason)

The computer is a part of the following security groups
-------------------------------------------------------
Firewall_Exception_ECommerce_Java
Firewall_Exception_Skype_For_ADS
1

Just as a user needs to log out and back in to reflect group membership changes, a computer needs to reboot to reflect group membership changes.

  • Unfortunately, I have performed a reboot to no avail. If I add the computer directly to the GPO and perform a gpupdate /force the GPO is applied immediately. I was also able to confirm the firewall change. I'm thinking it's a configuration issue, but I don't know what it could be. – pr- Aug 26 '15 at 19:10
  • Run the Group Policy Results wizard from the GPMC and confirm the group membership for the computer and verify that the GPO was applied. – joeqwerty Aug 26 '15 at 19:15
  • It shows the policy listed under the Computer Configuration Summary -> Group Policy Objects -> Applied GPOs However, it also shows the policy listed under User Configuration Summary -> Group Policy Objects -> Denied GPOs This policy doesn't contain any user configuration changes. So am I correct to assume that the denied GPO application is not a concern? – pr- Aug 26 '15 at 19:25
  • 1
    Yes, because there are no User Configuration settings defined. That's perfectly normal. You could disable the User Configuration settings on the Details tab, but that isn't necessary. – joeqwerty Aug 26 '15 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.