Anybody else having issues with GPOs not applying to Win10 all of a sudden?

[Jaan]

This seemed to work fine last week.

 

But today i noticed that a policy had not applied.

 

RSOP confirm it wasn't getting to the machine......

 

gpresult /scope computer /v

 

confirmed the machine was aware of it, but filtered it out for an "Unknown reason"

 

..... but it was working fine, i haven't done any updates? (although it worked on 1809 but this is the re release version of 1809 i'm having issues with)

 

after alittle Google session found something that might explain it;

 

https://community.spiceworks.com/topic/1762850-gpo-filtering-not-applied-unknown-reason

 

After completing the two steps below all my GPO problems went away!!

 

Since Microsoft added MS16-072: Security update for Group Policy: update to Servers :

 

"MS16-072 changes the security context with which user group policies are retrieved. This by-design behavior change protects customers’ computers from a security vulnerability. Before MS16-072 is installed, user group policies were retrieved by using the user’s security context. After MS16-072 is installed, user group policies are retrieved by using the computer's security context. This issue is applicable for the following KB articles"

 

For every GPO with user or group security filtering you must add to the "Delegation" tab "Authenticated users" group with permissions "READ". Security filtering can stay the same.

For every GPO with Computer security filtering you must add to the "Delegation" tab "Domain Computers" group with permissions "READ". Security filtering can stay the same.

 

Anybody else had this?

 

Doing the above doesn't seem to solve the issue for me, so i've reverted my changes.... any advice would be greatly welcome.

 

Down the rabbit hole i go.....again....

 

2016 dcs

win7 clients fine

win10 clients have the above issue.

Edited November 15, 2018 by Jaan

[Jaan]

UPDATE:

 

We have a machine running 1809 (before it pulled) and it's working fine.

 

 

And a "re-released" 1809 that isn't

 

 

i'll be back....

[Jaan]

SORRY GUYS!!!

 

i made a mistake.......

 

My test OU should be the same as my production OU with regards to GPOs etc...... and it isn't!

 

Moved the test re-released 1809 machine into the production OU fixes the issues.......

 

Sorry!

 

MODS.... please can you remove this thread so it doesn't cause any confusion due to my stupidness!

 

And so that my mistake isn't viewable for all eternity for all to see where people can point and laugh at me! "AH HA!"

Edited November 15, 2018 by Jaan