Home / server / Questions / 785484
Accepted
blacklight
Asked: 2016-06-23 00:25:23 +0800 CST

Group Policy Objects stopped applying to most security groups [duplicate]

  • 772

I have a Server 2008 R2 Domain with quite a few Group Policy Objects that should be applied to various OUs and security groups (Using security filtering).

I got reports from users that they were missing certain settings and things like mapped drives. When I started investigating the problem, I found that almost every single GPO in our domain has simply stopped being applied.

There are a few GPOs (Like the default domain policy) that are still being applied, and it looks like the one thing they have in common is that these policies are all applied to the 'Authenticated Users' builtin group. Whereas all other GPOs use security filtering on various other security groups.

I have run lots of RSOP tests (Planning and Logging) which both show that only the GPOs applied to 'Authenticated Users' are being run. The other GPOs don't even show up under the "GPOs that were not applied ..." section of gpresult. I have checked permissions, GPO inheritance, and a few other basic but common GPO problems, all of which seem fine. I tried creating a some brand new GPOs, and applying them to brand new security groups, however these were also not applied.

I have not noticed any other issues with Active Directory, authentication against these security groups for other functions (such as file permissions) all seem to be working as expected.

I'm at a total loss to explain why these GPOs just suddenly stopped getting applied, for no apparent reason. Does anyone have any ideas what might be going on, or how to continue troubleshooting?

windows-server-2008 group-policy active-directory

1 Answers

  1. Best Answer

    It is an issue with MS16-072. All user GPO's must have at least read permission for Authenticated Users.

    https://support.microsoft.com/en-us/kb/3163622

    MS16-072 changes the security context with which user group policies are retrieved. This by-design behavior change protects customers’ computers from a security vulnerability. Before MS16-072 is installed, user group policies were retrieved by using the user’s security context.

    Symptoms

    All user Group Policy, including those that have been security filtered on user accounts or security groups, or both, may fail to apply on domain joined computers.

    Cause

    This issue may occur if the Group Policy Object is missing the Read permissions for the Authenticated Users group or if you are using security filtering and are missing Read permissions for the domain computers group.

    Resolution

    To resolve this issue, use the Group Policy Management Console (GPMC.MSC) and use one of the following steps:

    • Add the Authenticated Users group with Read Permissions on the Group Policy Object (GPO).
    • If you are using security filtering, add the Domain Computers group with read permission.
    • 1