1

Currently, I have 2 GPO's in play for a new machine I just added to the domain. The second GPO (stagingGPO) is not showing up in the gpresult /r. The First (Power SettingGPO) is the only result in the report. However, when I check the local Policy settings for the StagingGPO they are set correctly on the newly added PC. The first GPO did have Loopback Processing set, I have set this back to the default of Not Configured. I ran gpupdate /force and then gpresults with the same results. Why would the StagingGPO not show in the results of gpresults?

Edit: Here is a screenshot of the RSOP for one of the Settings. RSOP.msc setting screen shoot enter image description here

Here is also the output from gpresult /r /v why are they different than what is displayed on screen.

Microsoft (R) Windows (R) Operating System Group Policy Result tool v2.0 c 2016 Microsoft Corporation. All rights reserved.

Created on 1/11/2017 at 2:12:46 PM

RSOP data for DOMAIN\xxxxxxxx on WKST02 : Logging Mode

OS Configuration: Member Workstation OS Version: 10.0.14393 Site Name: Default-First-Site-Name Roaming Profile: N/A Local Profile: C:\Users\xxxxxxxxxxx Connected over a slow link?: No

COMPUTER SETTINGS

CN=WKST02,OU=Staging,DC=xxxxx,DC=xxx
Last time Group Policy was applied: 1/11/2017 at 1:44:59 PM
Group Policy was applied from:      dc2.xxxxxx.xxxxxx
Group Policy slow link threshold:   500 kbps
Domain Name:                        xxxxxx
Domain Type:                        Windows 2008 or later

Applied Group Policy Objects
-----------------------------
    password
    disable ipv6
    root CA
    Prod-StagingOU

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
    Local Group Policy
        Filtering:  Not Applied (Empty)

    power settings
        Filtering:  Not Applied (Unknown Reason)

The computer is a part of the following security groups
-------------------------------------------------------
    BUILTIN\Administrators
    Everyone
    BUILTIN\Users
    NT AUTHORITY\NETWORK
    NT AUTHORITY\Authenticated Users
    This Organization
    WKST02$
    Domain Computers
    Authentication authority asserted identity
    System Mandatory Level

Resultant Set Of Policies for Computer
---------------------------------------

    Software Installations
    ----------------------
        N/A

    Startup Scripts
    ---------------
        N/A

    Shutdown Scripts
    ----------------
        N/A

    Account Policies
    ----------------
        GPO: password
            Policy:            LockoutDuration
            Computer Setting:  30

        GPO: password
            Policy:            MaximumPasswordAge
            Computer Setting:  90

        GPO: password
            Policy:            MinimumPasswordAge
            Computer Setting:  1

        GPO: password
            Policy:            ResetLockoutCount
            Computer Setting:  30

        GPO: password
            Policy:            LockoutBadCount
            Computer Setting:  5

        GPO: password
            Policy:            PasswordHistorySize
            Computer Setting:  10

        GPO: password
            Policy:            MinimumPasswordLength
            Computer Setting:  8

    Audit Policy
    ------------
        N/A

    User Rights
    -----------
        GPO: Prod-StagingOU
            Policy:            RemoteInteractiveLogonRight
            Computer Setting:  xxxxxx\ROL_RemoteDesktop_ADM

    Security Options
    ----------------
        GPO: password
            Policy:            PasswordComplexity
            Computer Setting:  Enabled

        GPO: password
            Policy:            ClearTextPassword
            Computer Setting:  Not Enabled

        GPO: password
            Policy:            ForceLogoffWhenHourExpire
            Computer Setting:  Not Enabled

        GPO: password
            Policy:            RequireLogonToChangePassword
            Computer Setting:  Not Enabled

        GPO: password
            Policy:            LSAAnonymousNameLookup
            Computer Setting:  Not Enabled

        GPO: password
            Policy:            @wsecedit.dll,-59058
            ValueName:         MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash
            Computer Setting:  1

        N/A

    Event Log Settings
    ------------------
        N/A

    Restricted Groups
    -----------------
        N/A

    System Services
    ---------------
        N/A

    Registry Settings
    -----------------
        N/A

    File System Settings
    --------------------
        N/A

    Public Key Policies
    -------------------
        N/A

    Administrative Templates
    ------------------------
        GPO: Prod-StagingOU
            Folder Id: SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\EnableFirewall
            Value:       0, 0, 0, 0
            State:       Enabled

        GPO: Prod-StagingOU
            Folder Id: SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\EnableFirewall
            Value:       0, 0, 0, 0
            State:       Enabled

        GPO: Prod-StagingOU
            Folder Id: SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fWritableTSCCPermTab
            Value:       0, 0, 0, 0
            State:       Enabled

        GPO: root CA
            Folder Id: Software\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots\Flags
            Value:       0, 0, 0, 0
            State:       Enabled

        GPO: disable ipv6
            Folder Id: SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisabledComponents
            Value:       255, 0, 0, 0
            State:       Enabled

        GPO: Prod-StagingOU
            Folder Id: SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fDenyTSConnections
            Value:       0, 0, 0, 0
            State:       Enabled

USER SETTINGS

CN=xxxxxxxxx,OU=Users,OU=Prod,DC=xxxxxx,DC=xxxxx
Last time Group Policy was applied: 1/11/2017 at 1:20:42 PM
Group Policy was applied from:      dc2.xxxxxx.xxxxx
Group Policy slow link threshold:   500 kbps
Domain Name:                        xxxxxx
Domain Type:                        Windows 2008 or later

Applied Group Policy Objects
-----------------------------
    power settings

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
    Local Group Policy
        Filtering:  Not Applied (Empty)


Resultant Set Of Policies for User
-----------------------------------

    Software Installations
    ----------------------
        N/A

    Logon Scripts
    -------------
        N/A

    Logoff Scripts
    --------------
        N/A

    Public Key Policies
    -------------------
        N/A

    Administrative Templates
    ------------------------
        N/A

    Folder Redirection
    ------------------
        N/A

    Internet Explorer Browser User Interface
    ----------------------------------------
        N/A

    Internet Explorer Connection
    ----------------------------
        N/A

    Internet Explorer URLs
    ----------------------
        N/A

    Internet Explorer Security
    --------------------------
        N/A

    Internet Explorer Programs
    --------------------------
        N/A
  • Why would the StagingGPO not show in the results of gpresults? - For any number of reasons. Look at "Denied GPOs" in your gpresult report. – joeqwerty Jan 11 '17 at 16:24
  • if the GPO was denied would it have still applied the settings the GPO is to apply? – TechGuyTJ Jan 11 '17 at 16:31
  • No. If the GPO was denied then the settings in the GPO would not have applied. It may be that the settings you're looking at have been applied by a different GPO or are the default settings. If you look at the settings in the gpresult report it will tell you what the winning GPO is, which is the GPO that set those settings. You might also want to run RSOP.msc on the machine in question as that may offer you a clearer picture of what settings are being configured and from where. Note that RSOP won't show any GPP if you're configuring them in your GPO. – joeqwerty Jan 11 '17 at 16:38
  • running RSOP.msc shows that the StagingGPO settings are being set and by that GPO. The question still remains, why would gpresult not list that GPO under the Applied Group Policy Objects? – TechGuyTJ Jan 11 '17 at 19:01
  • 1
    I'm voting to close this question as off-topic because this was not really a problem but a user error with reading the output. – TechGuyTJ Jan 11 '17 at 19:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.