We have set up a GPO that has a security filtering using security groups. The GPO is linked to the OU, the server is a member of the security group (IN THE AD - more in a moment).

We have not rebooted the server since it was added to a new group in AD, so the server does not know that it is a member of a new group. We can see this if we perform GPRESULT on the server. The new group is not shown.

But the GPO is applied, it works. I dont get why though.

  • @CharlesH I was under the impression that group policies were pulled, on a 90 minute interval (default) or when calling a GpUpdate. I have to admit though my knowledge of group policies is cursory, so I might be mistaken, feel free to correct me! – Reaces Sep 16 '15 at 9:05

The reason the GPO is applied, is because the client upon refreshing its group policy's queries active directory to find the gPLink attributes of the objects in active directory that it is a member of.

While it does not yet have the security group set up locally, the link does exist in Active Directory. And when the client queries Active Directory to find out which group policies it should process, it gets the relevant group policies pushed depending on its active directory membership, regardless of the local knowledge.

You can find an explanation of the gPLink attribute on a relevant technet blog. Together with more information on how group policies are applied.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.