0

I am having a spot of trouble with my policies and applying them on my Windows 10 machine.

I have several GPOs applied at the top of domain level, some contain only computer settings, some contain only user settings, and some contain both.

If I do a GPresult /r, I can see a GPO applied under user settings, that contains both user and computer settings. I can see a GPO applied under user settings, even though that policy contains NO user settings. Finally, I can see a GPO applied under user settings that DOES contain user settings.

What's then even more odd on top of that, is under user settings, I have 2 GPOs show as no applied (Unknown Reason), one of which is the default domain policy, but neither of them contain any user settings!

As far as I can tell, all computer policies are applying correctly, the issue lies in just user settings.

I need to figure out why GPOs show as applied even though they contain no user settings, and also why it shows an unknown reason for applying GPOs that also contain no user settings.

EDIT: Screenshot of gpresult: enter image description here Note that I have loopback mode enabled, so that's why they show up twice.

EDIT: Current delegation settings

Our default domain policy currently has these settings:

Creator owner - special


Authenticated users - read, apply


System - everything except full control and apply


Domain admins - read, write, create child objects


Domain computers - read, apply


Enterprise admins - read, write, create child objects


Enterprise domain controllers - read

EDIT:

So after recreating the "DOM-IE-CompatView" GPO with exactly the same settings as before, it no longer appears as "Not applied (unknown reason)"

Should I use dcgpofix to restore the default domain policy back to its default settings as well?

  • Can you provide a screen shot show the results of GPresult please? – Michael Brown Jul 22 '16 at 16:06
  • I have edited with screenshot of gpresult – James Edmonds Jul 22 '16 at 16:16
  • I compared DOM-IE-SiteZoneAssignment (which is applying correctly), to DOM-IE-CompatView (which isn't applying), and can see no difference between them in terms of security filtering or delegation! Would removing and rejoining my PC to the domain potentially help? – James Edmonds Jul 25 '16 at 11:55
1

The GPO's are applied because both Computer and User configuration settings are evaluated unless you configure the GPO Status (on the Details tab of the GPO) to User configuration settings disabled. Only then would they not be applied. The group policy engine doesn't know that there are no User settings configured, so it applies the GPO, at which point the Client Side Extensions evaluate the GPO to see if there are any settings that they're responsible for that need to be applied. No actual User settings are configured by the GPO because you don't have any User settings configured in the GPO, but the group policy engine needs to apply the GPO nonetheless and let the CSE's evaluate the GPO for settings that they may need to configure. If you want the group policy engine to not apply the GPO then you need to set the GPO status to User configuration settings disabled.

This article will give you a better idea of how Group Policy processing works. I think the information of most interest to you is the section labeled:

How the Group Policy Engine Processes Client-Side Extensions:

https://technet.microsoft.com/en-us/library/cc784268(v=ws.10).aspx

Can you post a screenshot of the Scope, Details and Delegation tabs of the Default Domain Policy?

  • Ok many thanks, that explains why ones with computer only settings appear. I will try to get the screenshots of the DDP over the weekend or Monday. It is applied at the domain level, no deeper, and should have authenticated users under security filtering, with the default delegation settings. – James Edmonds Jul 22 '16 at 23:38
  • Ok so I am not sure what the new default delegation options should be, but it looks like they have changed on the default domain policy and so far at least one other. I will edit my question to include details of the delegation as it stands. – James Edmonds Jul 25 '16 at 8:43
  • I have added the current delegation settings for default domain policy, and as far as I'm aware, it is sufficient for it to apply. Am I mistaken? – James Edmonds Jul 25 '16 at 9:31
  • is the point about policies showing even if they don't have user settings correct? I recreated my SiteToZone assignment GPO, which only had computer settings in, with exactly the same settings, and it no longer shows under User Settings in gpresult /r. The same is true for my CompatView GPO after being recreated! – James Edmonds Jul 26 '16 at 10:15
  • Hmm... I tested this when you originally posted your question and saw the same results as you in my own environment. I just tested it in a different environment and am seeing the same as you as of your latest update! I've worked with GP for years and thought I knew it pretty well, but now I'm wondering. I may have to delete this answer, but I want to do some more testing first. I'll post back here after I've done that. – joeqwerty Jul 26 '16 at 11:27
0

There was a major change in how group policy permissions work. If you applied patch KB3163622, and you use security filtering to determine how GPOs are applied, you'll probably have to make some changes to almost every group policy's permission scheme.

Here's an article that talks about what changed and how to resolve the issue: http://www.infoworld.com/article/3084930/microsoft-windows/microsoft-acknowledges-permission-problems-with-ms16-072-patches-kb-3159398-3163017-3163018-3163016.html

Basically, you'll need to make sure every GPO can be Read by Domain Computers and/or Authenticated Users.

To do that, use Group Policy Management RSAT tool and browse to your Group Policy Objects. Switch to the "Delegation" tab, and make sure either Domain Computers and/or Authenticated Users has Read permissions. For the GPOs missing these permissions, you'll need to hit the "Advanced..." button and Add "Read" rights to Authenticated Users and/or Domain Computers.

Do NOT add the "Apply Group Policy" permission unless you want the policy to apply universally.

After that, you should be able to run GPUPDATE /FORCE /BOOT to get your systems back in good shape.

  • Hi, Yes was aware of that change, but we don't use security filtering, so all of our GPOs already have authenticated users in the GPO. They all have default filtering and delegation except one, which isn't in the above list. – James Edmonds Jul 22 '16 at 23:36
  • Just to be absolutely clear, on the default domain policy's delegation tab, authenticated users is listed with read permissions, and also has "apply group policy" checked. So as far as I am aware, that should be applied? – James Edmonds Jul 25 '16 at 8:53
0

So I could not determine the root cause of the issue, but after having installed the anniversary update, all my applied GPOs show correctly, and the erroneous ones that said not applied (unknown reason), are not longer appearing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.