Group Policy - Security Filtering?

[DigiBen]

I used to be able to filter out GPOs by using security filtering, this was really useful if you wanted to apply a policy to only people that were members of certain groups.

 

This doesnt seem to work anymore, if your a member of group A. And your in the OU with the GPO (which is filtered to Group A) then it just doesnt process.

The only way it will process if you take the filtering out, and just leave Authenticated Users in.

 

Anyone found a way around this?

[Steve21]

Because they made a change recently where you "have" to have authenticated users in the delegation.

 

Leave the filter to Group A, but add Auth Users Read to Delegation and boom it works

 

Steve

[Scrai]

Here is an article that explains it all very, very well.

 

https://redmondmag.com/articles/2016/06/16/june-patch-breaks-group-policy-settings.aspx

 

Essentially MS changed the way GPO reading works and it is now done via the computer account. All GPOs must have the "Domain Computers" as a delegated permission with "Read" access. If you still want to scope the security filter down to users and remove "Authenticated Users' (Which by default includes all domain computers, hence why it works if left to default), then you need to give Domain Computers Read access.

 

GPanswers.com » Never a dull moment with Group Policy (or what to do about MS16-072)

 

The second link will have scripts to help you add "Domain Computers" to all current GPOs and add the group to all future created GPOs.

[DigiBen]

But arent all users Authenticated Users? I thought this would mean if I added Group A additionally, anyone would match this policy as they are all authenticated?

[Steve21]

But arent all users Authenticated Users? I thought this would mean if I added Group A additionally, anyone would match this policy as they are all authenticated?

 

The delegation is whether the users can "read" the policy etc A Group + Auth

 

The filter is who it applies to. So just A Group.

 

If that makes sense?

 

Steve

[Scrai]

But arent all users Authenticated Users? I thought this would mean if I added Group A additionally, anyone would match this policy as they are all authenticated?

 

Authenticated Users includes all users AND computers. The computers part is the important part now. MS changed it so computers now read all GPOs and decide if they apply or not. Not User accounts. So if you security scope computers out of the equation then the PC can literally not read any GPOs. Hence where the delegation comes in. You delegate all Domain Computers "Read" permission to all GPOs so they can decide whether the GPOs apply or not to the logging on User or Computer.