3

I am trying to apply a service through GPO Computer Management Preferences. I have an option that states "Apply Once And Never Apply Again".

Searching on this option comes up with this information:

If the Apply once and do not reapply option is selected, it changes this behavior, so the preference extension applies the results of the preference item to the user or computer only once. This option is useful when you do not want the results of a preference item to reapply.

Source: Apply once and do not reapply - What exactly this GPO setting means?

I want to know does this apply per computer when it restarts? Does that mean if I did a GPUpdate it will not reapply and try to start the service unless I put in an item to delete the RunOnce registry entry? I guess I am asking if the do once and not run again mean it only runs once ever unless you do a registry change?

Improve this question

2 Answers 2

Reset to default
4

"Apply once and do not reapply" means that the setting will be applied the first time the GPO is run against the target user or computer object, and isn't applied again on subsequent runs. It won't be re-applied on GPUpdate.

Think of this as setting a "get started" setting that the user can then change, for example setting a preference for the default homepage in IE to be www.example.com the first time a user logs in and generates their profile, but allowing the user to change the homepage themselves afterwards.

Improve this answer
5
  • So if I have a GPO that disables a service. And another that starts the service when it is enabled. Shouldn't the service stay on when GPO is applied when the Apply Once option isn't checked? Because I have a service that is set to Automatic but not running. The GPO applies both policies and the service starts 2 minutes after. Would it be good to use the Apply Once which would disable the service when the other GPO is off and then after I turn the other GPO of restart the computer or find another way?
    – JukEboX
    Mar 27, 2017 at 20:42
  • Sorry, perhaps its me because its late here but what you're talking about seems confusing to me. If you use a GPO with a preference set ti "apply once" to enable a service then the service will be enabled once. It won't subsequently be re-enabled if the service is manually disabled, or disabled by a GPO that runs after the first one in order of precedence. I guess I don't understand why you'd have a GPO that disables a service and another that applies it both running. That's going to have lots of potential for problems. Apply just the one that sets things the way you want it.
    – Rob Moir
    Mar 27, 2017 at 20:46
  • Due to security requirements the service must be disabled by default. Only during certain times is it allowed to run and that time is random so we can't code for it with a schedule.
    – JukEboX
    Mar 27, 2017 at 21:57
  • So you must be manually enabling the GPO when you want to control the service, one way or the other, right? If so then you're already manually controlling it so why not just create a set of scheduled tasks as a run one time task to set the service state and start/stop it. Then when you need to control the service you simply run the appropriate task. You're already manually taking action with your Group Policy (enabling and disabling the GPO link) but it's not working the way you expect so use a scheduled task instead. You're not creating any more work than you're already performing.
    – joeqwerty
    Mar 27, 2017 at 22:35
  • @joeqwerty Yeah I have had to alter a lot of my GPOs to establish the requirements I need. But your answer has been really helpful. Thanks.
    – JukEboX
    Sep 8, 2017 at 16:52
2

I can confirm the following happens after you change a file in the Unique ID source location on the Domain Controller but do not do anything else (i.e. un-tick/re-tick Apply Once) *when using the Replace option

  • On the destination device running gpupdate /force does not change any of the files
  • Logging off and on again does not change any of the files
  • Restarting does not change any of the files

When you change the files AND then change the Apply Once setting a new GUID will be created. Once group policy syncs machines recognize that change and update the files only once.

Additional information here: https://www.verboon.info/2013/05/how-to-reapply-a-group-policy-preference-that-is-configured-to-apply-once/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.