2

I have recently been experiencing an issue when attempting to push out Group Policy updates. The updates I am attempting to apply are basically just updating parameters in .txt file that resides on a user's PC. These .txt files are used to control a program used by most all users on our domain.

This being said, when I attempt to update my PC by issuing the follow command:

gpupdate /force

Or if I log off and log back on, my .txt file is updated successfully. I checked the Windows Event Viewer logs regarding Group Policy:

Applications and Services Logs/Microsoft/Windows/Group Policy/Operational 

And found numerous logs statements. It displays my account details, shows that I am connected to active directory, and lists the applicable group updates. One thing I noticed that was strange was the following:

Check out my list of applicable updates:

enter image description here

It also lists the following in the logs:

enter image description here

Where WOC_Updates is the policy that I am wanting to apply. It is a program written to perform the necessary PC updates.

On the affected PCs, I see the same account details, it shows that I am connected to active directory, and it lists the applicable group updates. However it lists a different set of applicable group updates:

enter image description here

It also does not list the "Starting Scripts Extension Processing." statements like in the screenshot above as it does for successful PCs.

All users are on the same domain with the same permissions to the locations being accessed. I am new to this area so any help on where to start would be greatly appreciated.

Thank you!

EDIT: Adding screen capture of GPO setup:

enter image description here

  • 2
    Did you removed authenticated user from the security group filtering on the GPO ? if so you need to set in the security of the GPO domain computer to read only to have the GPO work if so. – yagmoth555 Mar 23 '17 at 14:54
  • 1
    @yagmoth555: Yes. I completely forgot about that. I'm certain that you're correct. – joeqwerty Mar 23 '17 at 14:56
  • 2
  • 1
    A good blog post too, how to fix that error for ever too with ADSI Edit, if you create new GPO; gpanswers.com/… :) – yagmoth555 Mar 23 '17 at 15:04
  • 1
    Yes, it's correct in deleguation only, and you can test right now after as it's a user GPO – yagmoth555 Mar 23 '17 at 15:54
2

If you removed authenticated user from the security group filtering on the GPO, then you need to set in the security of the GPO domain computer to read only to have the GPO work.

As joeqwerty found the link, it's because of those update:

You could use that powershell command too if you have a lot of GPO in that situation !

Get-GPO -All | Set-GPPermissions -TargetType Group -TargetName "Domain computers" -PermissionLevel GpoRead

For your last question, Adding Domain Computers “indirectly”, by using the Delegation tab advantage and disadvantage or Adding DOMAIN COMPUTERS to Security Filtering section advantage and disadvantage, please check that blog post, it explain it more, but each way would work (but he suggest the indirect method like I told you)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.