As in the subject, does a GPO apply if "Security Filtering" tab is empty, but there is security group in Delegation which has Read and Apply rights?

Security Filtering tab says "The settings in this GPO can only apply to the following groups, users and computers:"

So does the security group must be also in the Security Filtering tab, or is it enough if it is in Delegation with correct rights?



As of today, adding an "Apply group policy" permission via the Delegation tab adds the security principal to the Scope tab automatically and vice versa. (Note, the "Read" permission alone is not sufficient.) I'm not sure if this is was a Windows Update and has been changed since you asked this question.

Therefore, the answer is yes: It is sufficient to add the principals through the delegation tab, provided you apply the correct permissions.


The delegation tab is used to allow users to manage group policies (Create group policies, edit them, link them to OUs or enforce them). That tab is not useful to define which user is going to be actually affected by the policy

In order to make the policies effective, you must add the groups to which you want to apply the policies in the Security Filtering tab.

This Technet article may help you:

Security filtering using GPMC

In order for the GPO to apply to a given user or computer, that user or computer must have both Read and Apply Group Policy (AGP) permissions on the GPO, either explicitly, or effectively though group membership.

  • You didn’t really answer his question, and I have essentially the same question: you can add a group or user or computer to the Delegation tab and “manually” give that entity Read and Apply rights. Is there any difference between manually setting the values for Read and Apply through the Delegation tab, or by adding the entity to the Security Filtering section under Scope (which then automatically appears as an entry under Delegation with Read and Apply anyway)?
    – Daniel
    Jun 25 '16 at 4:35

If you use the delegation tab of a GPO and click advanced you can assign the Read and Apply permissions to a user or group. if you do this (and if the GPO is linked to the correct level) then the GPO will apply to that user or group. more than this if you do use the delegation tab and click advanced and assign the read and apply permissions to a user or group then that user or group will appear in the security filtering section of the GPO.

in reverse if you edit the security filtering section and add a user or group then that user or group will appear on the delegation tab and if you look at advanced you will see that the user or group has appeared there with the read and apply permissions.

So the security filtering and the delegation tab advanced are doing the same thing!

However using delegation tab you can assign additional permission for the GPO so you could assign permission to edit the gpo for example. in short the delegation tab is more powerful but if you just want the GPO to apply to a user or group you can use either the security filtering or the adv section of the delegation tab.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.