I am trying to apply a GPO to the entire domain, however it is not applying to one single user.

Running gpresult advises that the GPO fails due to ; GPO Access Denied (Security Filtering).

The GPO is set to apply to the Authenticated Users group & this group has both the read/apply permissions. There are no conflicting groups/permissions.

The user has had gpupdate /force ran from an elevated prompt and has rebooted.

Is anyone able to help?

  • A WMI filter in place ? – yagmoth555 Aug 23 '17 at 10:40
  • No WMI filter is in place. – watsee Aug 23 '17 at 10:57

On the policy, if you look at Delegation, and click on Advanced, can you see that the users have set the Permissions to 'Apply group Policy'

| improve this answer | |

Probably solved by now. Answering to add options. Most likely cause of this is an explicit deny. Either in the GPO's delegation, per @user221530's answer, or in a user or group.

Confirm the scope. See if the user who can't apply GPO has the same problem on multiple machines. Confirm that this is the only user who can't apply the GPO. Write a PowerShell script to simulate GPO RSOP on an affected machine while looping through all the users in all the groups that the affected users are in. If you find a group where all the users in the group have the problem, then you've found where the explicit deny is.

When troubleshooting GPOs, be sure to use the PowerShell cmdlet Get-GpResultantSetOfPolicy command and send it to an html file. Be sure to run it against the users who cannot apply the GPO and again against the machines affected. The results are searchable. And the listing includes not just the winning GPO, but the list of ones that did not win for each setting. It may give more information than just GPO Access Denied (Security Filtering).

In this case

  • Check the GPO for delegation permissions
  • Check whether the Group Policy being denied is a domain GPO or a local group policy
  • Check the users objects in AD for explicit denies
  • Look for group membership and a group that might have an explicit deny
  • Perhaps reset the permissions on the users' objects inside AD.

If all else fails, back up the user's data, note the memberships and delete and recreate the account.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.