Windows Server 2022 — Group Policy Objects Not Applying to OU After Security Filtering Changes — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Quick Checks
3. Deep Diagnosis
4. Primary Fix
5. Verification
6. Prevention & Hardening

Symptom & Impact

Expected policies no longer apply to servers in a target OU after delegation or filtering updates. Baseline security settings drift and compliance findings increase. Configuration becomes inconsistent between newly built and existing systems.

Quick Checks

Review GPO link order, WMI filters, and security principals with Apply Group Policy permission.

Get-GPInheritance -Target 'OU=Servers,DC=contoso,DC=local'
Get-GPO -All | Select DisplayName,Id
gpresult /r /scope computer

Deep Diagnosis

Trace client-side extension processing and SYSVOL access to identify denied ACL or replication lag conditions.

Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' -MaxEvents 200
repadmin /replsummary
\contoso.localSYSVOL

Primary Fix

Restore required Authenticated Users read rights and explicitly assign apply permissions to target groups.

Set-GPPermission -Name 'Server Baseline' -TargetName 'Authenticated Users' -TargetType Group -PermissionLevel GpoRead
Set-GPPermission -Name 'Server Baseline' -TargetName 'GG-Server-Baseline' -TargetType Group -PermissionLevel GpoApply
gpupdate /force

Verification

Policy should appear in gpresult as applied and relevant registry or security settings must match baseline.

gpresult /h C:Tempgp.html
Get-ItemProperty 'HKLM:SoftwarePoliciesMicrosoftWindowsWindowsUpdate'
secedit /export /cfg C:Tempsecpol.cfg

Prevention & Hardening

Use change control for GPO ACL edits and monitor SYSVOL replication health continuously.

Get-GPPermission -Name 'Server Baseline' -All
Get-ADReplicationFailure -Target * -Scope Domain
Get-SmbShare -Name SYSVOL