GPOs not applying on Win7 only

[cakeinmilk]

This is a bit of an odd one.

 

I've verified that SYSVOL is replicating perfectly. New GPOs appear on both DCs in no time; they're just not all applying to Win7 machines (either user or computer policies). Win10 PCs in the exact same OUs using the exact same user work fine and pick up changes to the same GPOs immediately.

 

I've tried recreating them, importing the settings to a new GPO... No WMI filters are in operation and I've tried reimaging the machines to eliminate any GPO tattooing... These aren't Win10-specific settings either - they're relatively simple things like drive mappings. In event viewer I have a ton of 1085 errors:

 

"Windows failed to apply the Group Policy Printers/Drive Maps/Folder Redirection settings. Group Policy Printers settings might have its own log file. Please click on the "More information" link."

 

Servers are 2012R2 with a functional level of the same.

[cscc]

Sounds ACL related, are the permissions correct on the folders which are being redirected?

 

IIRC there was a bug with a certain W7 update which broke GPP drive maps. Required adding "Authenticated Users" read permissions to the "Delegation" tab.

Edited September 21, 2018 by cscc

[cakeinmilk]

I tried creating a new GPO to map the netlogon folder (standard permissions). Again, using same user worked fine in Win10 but not Win7.

I also tried adding Domain Computers explicitly to the Security Filtering on the GPO itself.

 

To your last comment - Authenticated Users have read permissions on the Delegation tab by default?

Edited September 21, 2018 by cakeinmilk

[cscc]

It has to be "Authenticated Users" in Delegation not in Scope. That's the only security group which cures this issue I believe.

 

Obviously applied to the policy which incorporates the GPP drive maps.

[cakeinmilk]

Sorry, replied to this in an edit - Authenticated Users have read permissions on the Delegation tab by default?

[cscc]

Does it have (read from security filtering) next to it?

[cakeinmilk]

Yes

[cscc]

Ok cool, thats the bug, so remove this and re-add the group and give it read. It should then not say (read from security filtering) next to it. This should resolve the issue.

[cakeinmilk]

Cool, so I removed it, which obviously removed it from Security Filtering. I then added Domain Users in the Security Filtering. No joy. I then explicitly added my test user in there. Still nothing, I'm afraid.

[cscc]

Did you add Authenticated Users back in with read? That's what cured it for me. Providing it doesn't have (from security filtering) next to it.

[cakeinmilk]

Yes, added that back in with Read, ran a gpupdate /force, and I can see it's being applied with gpresult, but still no mapped drives.

[cscc]

Odd, sorry I'm not sure in that case.

 

Possibly try Domain Computers with read?

 

I think it was KB3159398 that initially broke it but its now incorporated into a roll-up.

[cakeinmilk]

I tried that too, to no avail. Thanks for your help, regardless.

[cscc]

There's a thread here which may help:

 

https://social.technet.microsoft.com/Forums/en-US/e2ebead9-b30d-4789-a151-5c7783dbbe34/patch-tuesday-kb3159398?forum=winserverGP

 

Hope you manage to sort it.

[cakeinmilk]

Thanks - just uninstalling that update on both clients and servers.. fingers crossed.

 

Still no luck, unfortunately...

Edited September 21, 2018 by cakeinmilk