I am having an issue in my company.

I have a GPO, and one group in security filter, lets name it group X. In my delegation, I set the permissions to X (Allow Read and Allow Apply Group Policy).

The user is in the group X, and when I log on the computer, this GPO is denied by the security filter. How can I troubleshoot to identify where it is denying this GPO?

I don't know if this is relevant, but this group X denies another GPO and allows this specific one.


You probably removed Authenticated Users from the Group Policy, if so:

Add Authenticated Users back by using the "Delegation" tab and select "Read" on the role (very important). The Authenticated User should NOT be able to "Apply the Group Policy" but just "Read" the group policy (otherwise your filter based on the group membership will not work).

Since June 2016, the group policies are retrieved with the computer account (including users group policies), so you must allow the computers to read the policy settings.


You can use gpresult /scope user /h rsop.html to see the user’s RSoP (Resultant Set of Policy), which should provide detail about the security filtering on the GPO in question and why it isn’t applying the way you expect.

Be sure you’ve removed the Authenticated Users from the Security Filtering on the Scope tab if you only want your GPO to apply to users in group X; see this TechNet article for more info.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.