1

I went through some GPO documentation and it seems really straigforward but I'm still stuck, I have a OU called Users and I created a GPO that simply mapped a drive for a single user and I applied it to the OU called Users with a security filter for only that user (also when I enter in the name of the user I always check the name via the button on the right), the thing is when I do a GPresult /r it shows that the GPO is not applied to computer when the user is logged in and there is no drive mapping still, anything I do with specific users related to GPO's do not work, the only I know how to get working is computer policies and applying to authenticated users (basically everyone) or applying to specific computers through the security filter. Any ideas on what I can try? thank you for time!

  • What permissions are you assigning to the users when you filter them? – Michael Brown Apr 13 '17 at 8:01
  • In the "scope" under the "security filtering" I removed all users, groups, and computer objects and only added the users I wanted to have these mapped drives. – rapid3642 Apr 13 '17 at 9:12
3

There was an update in June 2016 that results in the situation that if you remove the Authenticated Users from the security filtering you can run in to trouble if the required systems cannot read the policy.

See the MS technet blog https://blogs.technet.microsoft.com/askds/2016/06/22/deploying-group-policy-security-update-ms16-072-kb3163622/

To fix this simply go to the Delegation tab of the policy and add the Authenticated Users with Read permission. Not read and apply, check what you've done with the advanced button.

  • Wow I was beating my head against the keyboard and doing countless hours of research but you hit it on the head in the first shot! Thank you so much! This issue is resolved and marked as the accepted answer, I do have another question tho if you dont mind answering, if not ill post it as a separate question. The GPO is now being applied successfully but the mapped drive is not showing, but when going to map it manually to test I DO see it already mapped in the mapping wizard and cant map it to that letter, is there a reason behind it not seeing it? I do have access to mapped location btw. – rapid3642 Apr 13 '17 at 9:16
  • @rapid3642 I had that one burned in to my memory because almost all of our GPOs use security filtering on security groups and they all broke after that update. I've always found drive letter mapping at startup a bit hit and miss. For the past couple of workplaces we've used startup scripts based on usernames to map drives. Though I have found that for some users who have admin rights the script runs in elevated priv mode, which maintains its own drive mappings separate from normal user mode mappings. – BeowulfNode42 Apr 13 '17 at 13:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.