User GPOs not applying

[realtnt]

Hi everyone,

I have setup a couple of Win10 machines to test them out and I'm having an issue where the user settings are not applying. The same settings are being applied and work fine on Win7 machines.

A gpresult on the win7 machines shows the following:

 

USER SETTINGS

--------------

CN=IT Support,OU=Staff,DC=xxxxx,DC=xxxxx,DC=sch,DC=uk

Last time Group Policy was applied: 24/05/2017 at 09:39:15

Group Policy was applied from: SERVER-DC01.xxxxx.xxxxx.sch.uk

Group Policy slow link threshold: 500 kbps

Domain Name: xxxxx

Domain Type: Windows 2000

 

but on the win10 machines:

 

USER SETTINGS

--------------

Last time Group Policy was applied: 23/05/2017 at 11:50:27

Group Policy was applied from: N/A

Group Policy slow link threshold: 500 kbps

Domain Name: LOCAL-COMPUTER

Domain Type: Windows 2008 or later

 

 

The Computer Settings GPOs are applied correctly on both win7 and win10. The server is 2012r2.

 

Any help would be appreciated.

 

 

Thanks,

 

Theo

[sted]

no wmi filter on the policy is there?

[realtnt]

No. No WMI filtering.

[dapaulio]

Out of curiosity what is your domain functional level?

And what is your oldest dc os

[TwistedHelixis]

Have you got the slow link gpo enabled. There are 2 settings but can't remember what they are called, but should have been setup as default back in the days of xp. Which is not that long ago if you are the NHS.

[TwistedHelixis]

I can post them tomorrow if you want. It might help, might not.

[mrwoberts]

Slow link GPOs...

 

User Configuration\Administrative Templates\System\Group Policy\Group Policy slow link detection
Computer Configuration\Administrative Templates\System\Group Policy\Group Policy slow link detection
Computer Configuration\Administrative Templates\System\Group Policy\Configure Group Policy slow link detection

[realtnt]

@dapaulio

We have two DCs both at 2008r2.

@TwistedHelixis @mrwoberts

I enabled 'Configure Group Policy slow link detection' both for User and Computer but didn't help. When I did a gpupdate /force the Computer Settings showed the change (I changed the threshold) but User Settings still showed per my original post.

 

 

The server was set up by Viglen with Classlink before I joined the school, but I'm not using that anymore, so I've made changes to their GPOs and/or disabled them.

[mrwoberts]

Do you have 'Authenticated Users' with at least Read permission on the GPO ?

 

Also, might be worth checking if KB3159398 is installed. If it is, temporarily remove it, reboot and test again.

[Duke5A]

Run "RSOP.MSC" and look at the User Configuration. If there is an exclamation point over the icon right-click it, select properties and look at the 'Error Information' tab. This will give you error codes and description pertaining to user GPO settings.

[dapaulio]

And what about your domain functional level. I have read some posts of windows 10 and certain compatibility issue with domain functional level lower than 2008. If your dc's are both 2008r2 then your domain functional level should be raised to match

[mrwoberts]

@realtnt

 

Here's how to determine your Forest and Domain Functional levels in Powershell

Get Domain Functional Level using PowerShell;

[color=#666666][font=&quot]Get-ADDomain | fl Name,DomainMode[/font][/color][color=#666666][font=&quot]

 

Get Forest Functional Level using PowerShell:[/font][/color]

 

[color=#666666][font=&quot]Get-ADForest | fl Name,ForestMode[/font][/color]

Edited May 25, 2017 by mrwoberts

[simpsonj]

Apologies for the necro thread raising, but I'm having the same issue with 1905.

 

Student logins have a less than 50% chance of applying the User GPOs, which is causing some grief!

 

I've tried turning off FastBoot, disabling slow link detection, and turning on 'Always wait for Network'. Appears to be random as to whether the GPOs are applied or not.

[simpsonj]

To answer my own question, one of the following seemed to help:

 

CPU GPO - Disabled Sleep

CPU & REG GPO - Disabled Fast Boot

User GPO - Turned off fast link detection (All links are fast links)

CPU GPO - Enabled Loop Back Processing

 

It doesn't help that my network is a bit poorly at present, and Group Policy isn't updating everytime. But once these GPOs were applied, I went from a 50% success rate, to a 90% rate, and I'm hoping the stragglers are because GP hasn't applied yet.