I have a GPO hierarchy like this:

enter image description here

On the client machine, using gpresult -r, I see Global has applied fine. However, Disable Control.exe hasn't.

The settings I am trying to configure:

enter image description here

Scope and filtering:

enter image description here

There is no VMI filtering.

I have made sure of the following:

  • The link is enabled.
  • The user logged in on the client machine, is a member of OU_One.
  • I forced the update with gpupdate/force.

Why is Global being applied, but Disable Control.exe not?

  • Can you show us what the scope/filtering are for the Disable Control.exe GPO are, and what settings (even if just high-level, without specifics) are being configured? – Jason Rush Dec 9 '17 at 23:38
  • @JasonRush I have added a screenshot of the settings being configured. Im quite new to Windows Server - where can I find scope/filtering for the GPO? – August Williams Dec 9 '17 at 23:41
  • The scope and filtering information are the first tab, where it shows what OUs the GPO applies to, what users or devices (usually defaults to Authenticated Users), and a 3rd section for WMI filtering (I believe). – Jason Rush Dec 9 '17 at 23:42
  • @JasonRush I have added screenshots. I hope this is sufficient information. Thanks. – August Williams Dec 9 '17 at 23:45
  • Does OU_One contain the users, computers, or both, that are being used for this testing? – Jason Rush Dec 9 '17 at 23:48

Based on your answers in the comments and chat, I think you're making this much more complex than it needs to be. You should not be using Loopback processing unless you have very specific reasons you need it.

To make the GPO block the Control Panel from all users in the Contractors group on any computer, you will want to:

  1. Remove the Loopback part of the GPO
  2. Remove Authenticated Users from the GPO security filtering
  3. Remove the OU_One OU link
  4. Add the GPO to whatever OU contains the actual users that are in the Contractors OU (note that the Security Filtering means you could apply this GPO at the Domain level, if the contractors are spread out too much)

Security Filtering only uses groups as a way to organize things (users, computers, etc). The things (users, computers, etc) must still be in an OU the GPO is linked to.

Loopback filtering is generally used for things like changing User policies on Terminal (Remote Desktop) servers, where you want to apply user settings but only on specific computers.


Group Policy, despite it's name, does not apply to security groups. Group Policy applies to users and computers. You can filter Group Policy so that it only applies to specific users or computers by adding those users or computers to security groups and then using those security groups as a filter for your GPO.

Your problem is that the security group that this user is a member of is in your target OU, but the user account for this user is not in the target OU. You need to move the user account for this user into the target OU. You don't need, and should remove, the loopback policy processing setting from the GPO.

Additionally, you have Authenticated Users in the filter for the GPO, which means the GPO will apply to all users that are in the scope of management of the GPO (all users that are in your OU). You need to remove Authenticated Users from the security filter of the GPO. When you do, make sure to follow the instructions at the link below to make sure that your GPO is configured appropriately.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.