2

One of our vendors is requesting that we provide Skype access, which uses specific ports and IPs. In order to facilitate the access, we need to deploy a set of Windows firewall rules. The target clients are spread across different OUs and therefore cannot be applied based on OU. Instead, I created a group with the users' machines. The problem is that the GPO doesn't apply to the machines. I've tried a gpupdate /force and a reboot, but the policies don't apply.

The interesting thing is that if I add the computers individually, the computers will get the GPO. It only appears to be the computer group that will not take the GPO.

The settings for the GPO are:

The GPO is applied at the toplevel of the domain and relies on security filtering.

My security settings are currently set to:

Read Allow Apply Group Policy Allow

enter image description here

Links:

Enforced No Link Enabled Yes

enter image description here

Security Filtering lists only my group. I removed authenticated users.

GPResults

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
Firewall Exception for Java for Ecommerce PCs
    Filtering:  Not Applied (Unknown Reason)

Firewall Exception - Skype for Business
    Filtering:  Not Applied (Unknown Reason)

The computer is a part of the following security groups
-------------------------------------------------------
Firewall_Exception_ECommerce_Java
Firewall_Exception_Skype_For_ADS
0

1 Answer 1

2

Just as a user needs to log out and back in to reflect group membership changes, a computer needs to reboot to reflect group membership changes.

4
  • Unfortunately, I have performed a reboot to no avail. If I add the computer directly to the GPO and perform a gpupdate /force the GPO is applied immediately. I was also able to confirm the firewall change. I'm thinking it's a configuration issue, but I don't know what it could be.
    – pr-
    Aug 26, 2015 at 19:10
  • Run the Group Policy Results wizard from the GPMC and confirm the group membership for the computer and verify that the GPO was applied.
    – joeqwerty
    Aug 26, 2015 at 19:15
  • It shows the policy listed under the Computer Configuration Summary -> Group Policy Objects -> Applied GPOs However, it also shows the policy listed under User Configuration Summary -> Group Policy Objects -> Denied GPOs This policy doesn't contain any user configuration changes. So am I correct to assume that the denied GPO application is not a concern?
    – pr-
    Aug 26, 2015 at 19:25
  • 1
    Yes, because there are no User Configuration settings defined. That's perfectly normal. You could disable the User Configuration settings on the Details tab, but that isn't necessary.
    – joeqwerty
    Aug 26, 2015 at 19:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .