GPO security group filtering not applying randomly

[Liam]

Ok so randomly today a handful of machines stopped applying GpO settings that had been scoped for security groups.

 

This has to be computer related as it's the same for staff and students and totally random.

 

If I add authenticated users the policy applies with rules out and dc replication issues in my eyes.

 

New one on me.

 

To get them up

And running I have created new gpo's under each individual ou. This seems to have sorted it.

 

Any suggestions?

[mrbios]

Assuming it started today: Windows update KB3159398

 

Remove that.

[Liam]

I suspected it was something to do with ms updates as I had to rebuild my wsus database today too..

[mrbios]

I'd recommend delaying windows updates deployment 1-2 weeks after patch tuesday in the future. Gives you a bit of time to let others find the problems

[Liam]

https://social.technet.microsoft.com/Forums/en-US/e2ebead9-b30d-4789-a151-5c7783dbbe34/patch-tuesday-kb3159398?forum=winserverGP

 

 

That's the one!! Thanks ms..

[Liam]

May need to look at my auto approval rules then.. Never had an issue before up until now though.. Nightmare.. I'm guessing you didn't get this issue then?

[mrbios]

May need to look at my auto approval rules then.. Never had an issue before up until now though.. Nightmare.. I'm guessing you didn't get this issue then?

 

Mine doesn't deploy until the 3rd wednesday of the month, and i try to keep one ear to the ground on dodgy updates from second Tuesday to my patching day I've pre-emptively removed the update from mine.

[internetuser]

It's the above Windows update. I had some Windows 7 thin clients excluded from my wus server effected. Which updated directly from Microsoft. Which prevented them working correctly.

 

Lucky it was a simple in install update to get working. Could have being nasty otherwise.

[mortstar]

Just FYI for those in here not looking at the other thread (http://www.edugeek.net/forums/windows-7/171517-windows-update-3159398-issue.html#post1469359), you shouldn't not install this update, you should instead change your Security Filtered GPOs as per Microsoft's KB article regarding this fix.

[Liam]

Yes I did that. I just did the powershell script and resolved any issues. Ms say it's by design. Sorted anyway