We have a domain, and it has a default domain policy that has existed for 16 years (since 2003):

enter image description here

I just realized today that this policy, with all its policies, are not being applied to any users or computers on the domain.

The simplest example of this is a Computer based QoS policy that exists in the Default Domain Policy:

enter image description here

But does not exist on any domain-joined machine:

enter image description here

Note: There are, of course, other policies:

enter image description here

Some set group policies, some create registry keys. None of them have any effect, or have an affect on the domain-joined machines or the domain users logged in to them.

The policy contains both per-machine, and per-user, policies, and neither are being applied.

The Default Domain Policy is Linked, and Enforced:

enter image description here

How do i make the Default Domain Policy apply to the domain?

  • You have to use GPRESULT or RSOP to show the GPOs and settings applied on your client. The LOCAL Policy Editor just shows yout LOCAL ("additional") changes, not the ones from the domains GPO. – bjoster Jan 4 '19 at 17:01
  • Side note, don't "enforce" a policy unless you have a specific reason to do so, like to override an inheritance block, or a conflicting setting being applied later in processing. Enforcing without reason just further complicates troubleshooting. – Semicolon Jan 4 '19 at 17:23
  • @Semicolon As far as i know nobody "enforced" anything. The policy is the way it is, and i don't even know what "enforce" means. (Well, i know what enforce means, but i don't know what it means for a group policy to be enforced, or for a group policy to not be enforced. It would seem to have a group policy not forced upon users - what's the point of a group policy if users can choose to ignore them) – Ian Boyd Jan 4 '19 at 17:58
  • I mentioned it because according to your screenshot, the DDP link is enforced - as evidenced by the padlock icon on the link. This is not default, so somebody did it. Now, as there are essentially no other GPOs in place, collateral damage is non-existent. It was just something I noticed, and thought I would share. As for unexperienced administrators, "enforcing" a GPO link is usually a first step taken to get a GPO is working if it is not currently (which is kinda where you thought you were). As for the rest of your comment, I suggest research, as I am at my character limit. – Semicolon Jan 7 '19 at 15:56

The local Group Policy editor doesn't show you domain Group Policy settings, it shows you local Group Policy settings. If you want to see what domain Group Policy settings are applied to the machine/user then run RSOP or GPRESULT on the machine in question.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.