1

I'm running into an odd situation: domain group membership as reported by Group Policy differs from that of Active Directory.

DOMAIN\user.name was already a member of DOMAIN\some_group_1. I added it to the AD group DOMAIN\some_group_2. The command gpresult /v now reports that DOMAIN\user.name is NOT a member of DOMAIN\some_group_2, while the Active Directory Users and Computers snap-in clearly shows that it is.

Both groups have Global scope and were created using the WSE 2016 Dashboard.

This situation is preventing Group Policy Preferences from creating a registry entry for this user, an entry that's targeted for all users in DOMAIN\some_group_2.

Why isn't Group Policy picking up the new membership?

As an aside, Get-ADPrincipalGroupMembership user.name run at the DC reports that the user is a member of Domain Users only.

--EDIT--

I should clarify that I'm connecting to the domain using two computers via two methods: 1) LAN; 2) Remote VPN. The symptoms are identical on both connections.

| improve this question | |
  • You are aware that group membership changes don't take effect until the user logs out and back in? Have you checked what whoami /groups says for the user? – Harry Johnston May 4 '19 at 3:05
  • @HarryJohnston ~ Signing out and back in yields no improvement. whoami /groups reports the same membership info that gpresult /v does — DOMAIN\some_group_2 isn't present in either list (but it is present in the snap-in at the server). – InteXX May 4 '19 at 3:24
  • Do you have more than one site? If so, where was the change to the group membership made? Has the change to the group membership replicated to all other DC's? What does gpresult /r state about what DC that GP was applied from? – joeqwerty May 4 '19 at 3:45
  • @joeqwerty ~ A limitation of WSE is that you can have only one DC. You can have a member server, but no BDCs are allowed. In this case it's hosted in a VM, but that probably isn't relevant to this issue. I'm connecting to the domain using two computers via two methods: 1) LAN; 2) Remote VPN. The symptoms are identical on both connections. – InteXX May 4 '19 at 4:44
  • 1
    The problem isn't in group policy, if it were just GP then whoami would have shown the right groups. The Windows authentication process isn't/wasn't functioning properly for some reason. – Harry Johnston May 4 '19 at 20:44
1

I found the problem.

I'd connected to the VPN under the domain admin account so that I'd be able to create the new profile for the standard user account. But I hadn't yet added the user account to the VPN security group in AD, so the new profile was corrupted as of its creation.

I removed and recreated the profile, and all was well. It works correctly now, and all security groups are displaying as they should.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.