Windows Server 2012 R2 Domain with users logging into a Windows Server 2008 R2 terminal server:

I've got a simple User GPP which implements a registry edit on the Windows 2008 machine. The registry edit has Item Level Targeting enabled which targets the Windows Server 2008 computer specifically, using its DNS name (computer.domain.com).

In security filtering it is restricted to only a single user group some.users. I've checked the Delegation tab and some.users has both Read access and Apply Group Policy. I have also added Domain Computer with Read access to the permissions list.

When I run gpresult /user:specific.user /h gpresult.html I am receiving an Access denied (Security Filtering) error. Inexplicably, when I also check the applied group membership in gpresult.html, it is showing domain\some.users.

I'm really stuck here, as gpresult shows specific.user as belonging to some.users group, and some.users has Read and Apply access in Security Filtering, so why is it getting denied?

I even tried creating a brand new test.user and test.group and changing the Security Filtering to apply ONLY to test.group, and the policy applied successfully when I logged in as test.user! But when I change it back to some.users, it starts getting denied again if I log in as specific.user. :(

  • Try it without item-level targeting. I suspect that may have something to do with it. – joeqwerty Sep 11 '16 at 0:20
  • ok, but it would show me Access Denied (Security Filtering) if it was failing the Item-Level Targeting check? also, why would it have worked - the very same GPO just with a different security filter - when I changed it to test.group? – Daniel Sep 11 '16 at 1:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.