I have a GPO I created that adds a registry value (USER CONFIGURATION -> PREFERENCES -> WINDOW SETTINGS -> REGISTRY). I want it to target a specific group of users that are in a security group I created. The security group I created is called Remote Access VPN Users. I've added myself to said Security Group (did this over a week ago), confirmed replication. Under the SCOPE tab, under Security Filtering, I removed Authenticated Users and added the Remote Access VPN Users security group. Saved and forced gpupdate but it never creates the registry entry.

I tested using Group Policy Results and it keeps telling me that the GPO was Denied because it's inaccessible. Why is it not applying to my Security Group? When I removed the Security Group and add Authenticated Users back to the GPO Scope filtering it works as expected. However, I don't want this to apply to Authenticated Users

Do I need to use a Distribution Group instead of a Security group? The policy is linked to my domain.


If you remove authenticated user, you need to add an entry, domain computer/read in the security. Its a new security MS fixed last year

enter image description here

For the explication please see there;


  • Thanks for the quick answer, but where do you exactly mean I need to add an entry? And what type of entry? – ItsPronounced Sep 18 '17 at 19:48
  • @drpcken please see the edit, now better :) – yagmoth555 Sep 18 '17 at 19:58
  • 1
    @yagmoth555 - I'm surprised this doesn't come up more than it does here. MS was very stealthy about releasing that update last summer. – TheCleaner Sep 18 '17 at 20:13
  • @TheCleaner I agree! my theory, from what I seen at job, is that old gpo & old user that got a cached profile seem less impacted, only new user or if you create a new gpo. Kinda a timebomb. – yagmoth555 Sep 19 '17 at 0:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.