Group Policy User Config Frustrations

[Gongalong]

Hi folks,

 

Can I check my understanding with group policy, because I've had a couple of issues recently trying to apply user configs with a GPO.

 

Under security filtering for the GPO, if I remove authenticated users and add a security group with users, should the GPO apply to that group? In practice it doesn't seem to. Am I doing something wrong?

 

I note that removing "Authenticated Users" prompts with the message re. it being a necessary group etc. etc. and should at least have read only permissions, but if I add authenticated users then unsurprisingly the GPO applies to all users that login, and I don't want that.

 

Thanks

[AlphamaleZed]

Is the security group setup correctly? i have had no issues. Worst case scenario make a sub OU and apply it there.

 

3. Configure Security Filtering

 

1. Open Group Policy Management

2. Select the GPO

3. Under Security Filtering:

    

   • Remove Authenticated Users

   • Add GG_Finance_Users

 

This ensures only Finance users process the GPO.

 

 

4. Verify permissions (this matters)

 

The Finance group must have:

 

• ✅ Read

• ✅ Apply Group Policy

 

If either is missing, the GPO will be ignored.

[Gongalong]

I'm testing at the moment, but the security group has my test user in it (double checked). The GPO has just this test group set under security filtering. Delegation shows the security group there also with read and apply group policy set (I'm guessing this got carried across from security filtering, because it wasn't added manually). I've run a gpupdate /force on the test PC, which forced a sign off. I sign back in and... it's not applied. If I use the group policy results wizard to check that PC and user, it also shows the policy is not applied. The GPO is linked in the root of the domain, in case that has any bearing. There are no other GPOs with these settings applied that it could conflict with. I feel like I must be missing something basic, but not sure what.

[StephenPink]

I remember having this issue before - can't remember if it was a bug or what, but basically the computer also needed to be able to "read" the policy.  So adding the relevant user group in the security filtering AND the "Domain Computers" group resolved it

[AlphamaleZed]

3 minutes ago, Gongalong said:

I'm testing at the moment, but the security group has my test user in it (double checked). The GPO has just this test group set under security filtering. Delegation shows the security group there also with read and apply group policy set (I'm guessing this got carried across from security filtering, because it wasn't added manually). I've run a gpupdate /force on the test PC, which forced a sign off. I sign back in and... it's not applied. If I use the group policy results wizard to check that PC and user, it also shows the policy is not applied. The GPO is linked in the root of the domain, in case that has any bearing. There are no other GPOs with these settings applied that it could conflict with. I feel like I must be missing something basic, but not sure what.

Does the PC have read permission? the sec group needs read and apply.

maybe try the enforce option to see if anything happens?

 

How do GPOs apply? check under here:

Computer Configuration

 └ Administrative Templates

   └ System

     └ Group Policy

       └ User Group Policy loopback processing mode

 

it doesnt work well if your GPO refresh cycle replaces and not merges as well the timing it applies the GPO.

[Sephiroth]

The security filter should have the 'Authenticated Users' removed, but that also removes it from the security settings, meaning that Windows won't be able to read the policy to apply it.

 

You need to add 'Authenticated Users' back into the security settings with read permissions for it to apply.

[Koldov]

I'm not sure if iirc but there was something a while back about authenticated users needing to be in there because it included the computer objects that need to read the policy...

 

I've just checked a few of mine and they all have Authenticated Users in as Read (which I think was the advice at the time).

 

However the GPO doesn't apply to all the users because the GPO is in an OU with only the people in it that the GPO applies to... if that makes sense?

 

Are you trying to put the GPO in an OU with say 10 users, but only have it apply to 5 (or is this a ROOT policy)?

 

EDIT: As said above, the Domain Computers way might be what you're looking for. I did read that was possible but couldn't be bothered to go through hundreds of GPOs as mine work OK as they are.

 

Also:

 

https://community.spiceworks.com/t/does-group-policy-always-need-authenticated-users/807412

 

 

Edited January 22 by Koldov

[Sephiroth]

I've put some examples in here. This is from an object applied to computers for software installation depending on group membership, but the premise is the same.

 

 

[Gongalong]

Thanks all for the replies. Sephiroth + Koldov, it does indeed look to be that authenticated users must be added with only read permissions to delegation. I'll do some more testing to be 100% sure.

[Gongalong]

Hmm, it seems that adding authenticated users has now started applying that GPO to all logged in users. Not just the users in the group added under security filtering. Is that to be expected? Should I add deny permissions to authenticated users, or is that going to stop the GPO working?

[Sephiroth]

It should only apply to objects that match the security filter. I assume your security filter on the 'Scope' setting has only the object that you want affected?

 

The screenshots I listed are from a fully functional GPO in my domain, as that's how we primarily do device specific software installation. We used to have the same settings in production for users, but don't any more.

 

What does Group Policy Results show for that GPO against your users, both that you're expecting it to apply to and not?

[Gongalong]

Scope is set only to the user group I want the GPO applied to. (The GPO only changes one setting under User Config)

I can see if the setting has taken effect because another bit of software (NetSupport Notify) will report on which machines have the setting applied or not. My only thought is whether some of these other machines that appeared were from when I previously had authenticated users also in scope, and we've got bits of GPO catching up. To test I will change the value I had used, reinstate authenticated users in delegation, and see if the value changes for multiple machines.

Group policy results shows the policy as being applied on the machines I've looked at, but I'm not sure if as above it's picking up previous changes that took effect.

I'll test this change and report back...

 

Edit: just to add for reference, this GPO is in the root. I want to scope it using a security group, rather than an OU, as it has to apply to a small group of users.

Edited January 22 by Gongalong

[Gongalong]

All looks to be working this morning, so it does look to be that adding of authenticated users with read permissions was the fix. Thanks again!

[Sephiroth]

Glad its working. Until MS kill off Group Policy in favour of Intune, at least. Can't wait for that one... 😒

[AlphamaleZed]

21 minutes ago, Sephiroth said:

Glad its working. Until MS kill off Group Policy in favour of Intune, at least. Can't wait for that one... 😒

Im 50/50 with it. intune device polices are good and the search feature is a godsend but few bits lacking:

• folders and subfolder needed for configuration policies
• not everything there 
• user policies need to update faster rather than later on

I know JAMF is different but when pushing out policies its rapid fire!