Windows – Group Policy for DNS Server Addresses

You're seeing the dreaded scourge of asynchronous policy processing. It's not a "feature" (and was default-off in Windows 2000 but default-on in Windows XP and above) and causes exactly what you're seeing-- non-deterministic behaviour with processing some types of GPO settings.

In a GPO that applies to that computer, add the following setting:

• Computer Settings
  • Administrative Templates
    • System
      • Logon
        • Always wait for the network at computer startup and logon - Enabled

After you set that (and allow the GPO to replicate if you're in a multi-DC environment), do a "gpupdate /force /boot" on the subject PC. It will reboot and you should see the software installation occur.

The "Always wait for the network at computer startup and logon" slightly slows down the startup and logon because all GPO extensions are allowed to process, but the upside is that all GPO extensions are allowed to process.

You won't see the results of Group Policy Administrative Template application in Local Computer Policy. You want to be using the "Resultant Set of Policy" tool to see what GPOs are applying to the computer.

If you're not seeing the GPO(s) you expect to be applying to the client computer, review the Application and System event logs and be sure that you're getting good name resolution and not seeing any errors related to Group Policy application. Bad DNS settings on clients are notoriously the cause of Group Policy failing to apply.