2

Basically I have created a home virtual lab to practice Active Directory, I have a virtual version of Windows server 2016 running on my Desktop using Hyper - V, and I have another physical laptop that I am using as the client machine

Everything is running smoothly, however I cannot get a GPO to apply to a specific security group even though I have linked it to an OU that hierarchically includes the OU that the users sit in (hopefully that makes sense)...

Theses are the screen shots I have taken to help understand

https://res.cloudinary.com/dlkdmqcop/image/upload/v1552599131/AD_USERS_fa9yb2.png

https://res.cloudinary.com/dlkdmqcop/image/upload/v1552599131/GPO_hhplok.png

I have likned the GPO to the OU SWI, and am trying to apply it to the Security group UK-SWI1-GG-USERS.

The GPO works perfectly fine if I keep it as Authenticated Users.

Any info would be greatly appreciated.

migrated from superuser.com Mar 14 at 22:09

This question came from our site for computer enthusiasts and power users.

  • Your screenshot cuts off the Security Filtering portion of the GUI. Can you provide a screenshot that shows that part? – Doug Deden Mar 14 at 22:36
1

In order for user group policy to be applied, the computer that the user is logging into must have access to read the group policy object.

By default, i.e., if the GPO is unfiltered, Authenticated Users has both "Apply Group Policy" and "Read" permission and everything just works. If the GPO is filtered to a particular group, however, you must explicitly grant the necessary read permission to the computer(s) in question.

In most cases, you should use the Delegation tab to give Authenticated Users read access.

In the rare event that the content of the group policy object is sensitive (e.g., it contains a password) you might prefer to give read access to the Domain Computers group instead, or perhaps even just those particular computers that need to be able to apply the group policy. Note that this does not provide comprehensive protection against a malicious user obtaining access to the contents of the group policy object. Group policy objects should not contain sensitive information such as passwords.

This behaviour was first introduced in a security update back in 2016, and is described in the Microsoft article Deploying Group Policy Security Update MS16-072 \ KB3163622.

  • This has hit the nail on the head, thank you so much. I will have to keep up to date in the future 🤗 – Elbow.Wizard Mar 14 at 23:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.