Windows – GPO not applying to OU security group

active-directorygroup-policywindowswindows-server-2016

Basically I have created a home virtual lab to practice Active Directory, I have a virtual version of Windows server 2016 running on my Desktop using Hyper – V, and I have another physical laptop that I am using as the client machine

Everything is running smoothly, however I cannot get a GPO to apply to a specific security group even though I have linked it to an OU that hierarchically includes the OU that the users sit in (hopefully that makes sense)…

Theses are the screen shots I have taken to help understand

https://res.cloudinary.com/dlkdmqcop/image/upload/v1552599131/AD_USERS_fa9yb2.png

https://res.cloudinary.com/dlkdmqcop/image/upload/v1552599131/GPO_hhplok.png

I have likned the GPO to the OU SWI, and am trying to apply it to the Security group UK-SWI1-GG-USERS.

The GPO works perfectly fine if I keep it as Authenticated Users.

Any info would be greatly appreciated.

Best Answer

In order for user group policy to be applied, the computer that the user is logging into must have access to read the group policy object.

By default, i.e., if the GPO is unfiltered, Authenticated Users has both "Apply Group Policy" and "Read" permission and everything just works. If the GPO is filtered to a particular group, however, you must explicitly grant the necessary read permission to the computer(s) in question.

In most cases, you should use the Delegation tab to give Authenticated Users read access.

In the rare event that the content of the group policy object is sensitive (e.g., it contains a password) you might prefer to give read access to the Domain Computers group instead, or perhaps even just those particular computers that need to be able to apply the group policy. Note that this does not provide comprehensive protection against a malicious user obtaining access to the contents of the group policy object. Group policy objects should not contain sensitive information such as passwords.

This behaviour was first introduced in a security update back in 2016, and is described in the Microsoft article Deploying Group Policy Security Update MS16-072 \ KB3163622.

Related Topic