I am building a test Active Directory forest in a virtual environment. I will be part of a team in the future that will build a new Forest for our organization. I don't have experience managing a forest or domain in a production environment, but I am familiar with GPOs and working with them as a Sys Admin. I'm using Server 2019 and the Forest and Domain Functional levels are at Windows Server 2016 (that's the highest version available). I created a new GPO to add our security settings, linked the new GPO to the Domain Controllers OU, did gpupdate /force (this indicates it completes successfully), rebooted, its been a day or so and I go to verify some settings have been applied. gpresult shows the GPO is applied, but numerous settings that are set in the GPO, are not set in the gpresult output. Here are two examples: I have "Computer Configuration >> Windows Settings >> Security Settings >> Advanced Audit Policy Configuration >> System Audit Policies >> Logon/Logoff >> "Audit Account Lockout" set in the GPO to audit success and failure. I also have the "Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" enabled. But this isn't applied to the server at all. Running "AuditPol /get /category:*" and looking at the output confirms this. The second example is "Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Account Policies >> Account Lockout Policy". I have it set to three, but it is not applied in the gpresult output.
In both of those examples, gpresult indicates that local policy is the winning gpo.
There are other settings that are missing. There are also settings in the gpresult that have applied from the GPO. Anything I could be missing? Thanks in advance.