We have had about 20 print mapping policies for years in an organization with ~300 clients. This company hasn't done windows updates in over 2 years. Over the weekend, we were authorized to push out ALL windows updates needed to bring us current (after testing). It turns out we missed an edge situation; the entire subset of printer deployment group policies no longer make it to clients.
The policies haven't changed, but they do not show up at all. If we do RSOP or gpresult, they don't even show as not applied. Our exempted computers still receive and execute the policy normally, including a freshly imaged computer with an old image.
When running "gpupdate /force" we get an error on the afflicted computers, with the following text:
The following warnings were encountered during user policy processing:
The Group Policy Client Side Extension Folder Redirection was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.
Computer Policy update has completed successfully.For more detailed information, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.
Certain User policies are enabled that can only run during logon.
OK to logoff?. (Y/N)
Allowing it to log off, rebooting, etc. does not change the result. Subsequent executions of the command show the same message. The GPResult output does not mention the printer policies, or any failures.
This is happening on Windows 7 and Windows 10. Some of the policies map computers through "Deployed Printers" and some through "Control Panel." Neither show up at all anymore.
We are now going through the process of uninstalling updates 1 by 1 to see what changed (there are 278) but we're completely stumped as to what could cause the policy to not even propogate. Nothing has changed on our Windows Server 2008 domain controllers, and the policies show on all 3.
Any troubleshooting thoughts would be appreciated.
Best Answer
My guess would be the policies do not have Authenticated Users security principal with Read permission.