Windows Server · Windows  ·  medium  ·  Active Directory deep faults

A Group Policy setting is not applying and gpresult does not explain why

The policy is linked and enabled, and something in the processing rules is excluding this user or machine.

What you see

A setting configured in a GPO simply does not appear on the client. gpupdate /force reports success.

What is actually wrong

Security filtering, a WMI filter, the setting being in the wrong half of the policy, block inheritance, or loopback processing on the target machine.

Codes and articles

gpresultDenied (Security)Event 1085Event 7016loopback processingWMI filter

Fixes (2)

Check the user side of processing
Elevated PowerShell on the client30 minuteslow riskreversible

A user setting.

  1. Get the full report as the affected user, not as an administrator.

    PowerShell
    gpresult /h $env:USERPROFILE\Desktop\gpo.html /fStart-Process $env:USERPROFILE\Desktop\gpo.html

  2. Look at the Denied GPOs section, which states the reason for each — Security, WMI Filter, or Not Applied (Empty).

    This section answers the question directly and is below the fold, so it is routinely missed. "Denied (Security)" means the user is not in the security filtering; "Empty" means the half of the policy being used has nothing configured in it.

  3. Check the user object is in an OU the policy is linked to. A user in a different OU from their computer is the most common cause of a user policy not applying.

    PowerShell
    Get-ADUser jbloggs | Select-Object DistinguishedNameGet-GPInheritance -Target 'OU=Users,OU=Site,DC=example,DC=local' | Select-Object -ExpandProperty InheritedGpoLinks

  4. Check security filtering includes the user, and that Authenticated Users still has read permission — a common hardening change removes it and silently breaks the policy.

    PowerShell
    Get-GPPermission -Name 'My Policy' -All | Format-Table Trustee,Permission

    After the security update that requires it, a GPO where Authenticated Users has been removed entirely does not apply to anyone, even accounts explicitly listed in the filtering. The computer account needs read access for the policy to be retrieved at all.

  5. If the setting must apply based on the machine rather than the user, enable loopback processing on that machine's policy.

Confirm it workedgpresult shows the policy applied and the setting present.
PowerShell
gpupdate /forcegpresult /r /scope:user
If you need to undo itPermission and link changes are reversible in the Group Policy Management console.
Check the computer side and the WMI filter
Elevated PowerShell on the client30 minuteslow riskreversible

A computer setting.

  1. Run the report for the computer scope.

    PowerShell
    gpresult /r /scope:computergpresult /h C:\gpo-computer.html /f /scope:computer

  2. Test any WMI filter directly on the client — a filter that returns nothing silently excludes the policy.

    PowerShell
    Get-CimInstance -Query "SELECT * FROM Win32_OperatingSystem WHERE ProductType = '3'"

    Running the filter's own query on the client gives an immediate yes or no. A filter that was correct when written and no longer matches — because the OS version moved on — is a very common cause.

  3. Check for block inheritance and enforcement on the OU chain.

    PowerShell
    Get-GPInheritance -Target 'OU=Servers,DC=example,DC=local' | Format-List GpoInheritanceBlocked,InheritedGpoLinks

  4. Check the client can reach SYSVOL to read the policy files.

    PowerShell
    Test-Path "\\$env:USERDNSDOMAIN\SYSVOL\$env:USERDNSDOMAIN\Policies"Get-WinEvent -LogName 'Microsoft-Windows-GroupPolicy/Operational' -MaxEvents 30 | Format-Table TimeCreated,Id,Message -Wrap

  5. Remember that a computer policy applies at boot. A machine that has not restarted since the policy was created will not have it.

Confirm it workedThe policy appears in the applied list and the setting is in place after a restart.
PowerShell
gpupdate /force /bootgpresult /r /scope:computer
If you need to undo itNo client changes were made.

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.