Balaji Ramamoorthy
Download CV

Group Policy is linked but not applying: how to find out why

Real issue · 2 min read

A step-by-step check using gpresult and the event log, with the security filtering change (MS16-072) that catches many engineers out.

Share on LinkedIn

Symptom

A Group Policy Object is linked to the right organisational unit, but its settings do not reach the computers or users. gpupdate /force runs without an obvious error, and the setting does not change.

Where it happened

Domain-joined Windows servers and PCs, most often after a new GPO was created, after security filtering was changed, or after a domain controller or SYSVOL problem.

What I checked

Start on the affected computer, not in the console:

gpupdate /force
gpresult /h C:\Temp\gp.html /f

Open the report. The section for applied objects lists what applied. The denied section gives the reason for each GPO that did not, such as "Denied (Security)", "Denied (WMI Filter)" or "Empty".

Then look at the events:

Get-WinEvent -FilterHashtable @{ LogName = 'System'; ProviderName = 'Microsoft-Windows-GroupPolicy'; Level = 2, 3 } -MaxEvents 20 |
  Format-Table TimeCreated, Id, Message -Wrap

Event 1058 means the machine could not read the policy files from SYSVOL. Event 1030 means it could not read the policy list.

Root cause

The cause is almost always one of these:

  1. Security filtering. Since the security update MS16-072, user policy is read using the computer's identity, not the user's. If you removed Authenticated Users from the GPO and only added a user group, the computer account cannot read the policy, and it is denied.
  2. A WMI filter that does not match the machine.
  3. SYSVOL or DNS problems: the machine cannot reach \\contoso.com\SYSVOL or the files differ between domain controllers.
  4. Link order, enforcement or blocked inheritance put another policy ahead.

The fix

For the security filtering case, keep the group you want in the Apply list, and give Authenticated Users (or Domain Computers) the Read permission only, under the delegation tab. Do not tick Apply for them.

For SYSVOL problems, check that the path opens from the affected machine and that the domain controllers agree:

Test-Path \\contoso.com\SYSVOL
dcdiag /test:sysvolcheck /test:advertising

Fix DNS first if the domain name does not resolve to a domain controller. Then run gpupdate /force and generate a new gpresult report to confirm the GPO now shows under applied objects.

How to stop it happening again

  • Name GPOs by purpose and scope, and keep one setting group per GPO.
  • When using security filtering, always keep the Read permission for computers.
  • Test new policy on a small organisational unit first, and keep the gpresult report as evidence.