Inheritence not working in GPO

Because the GPO is linked directly to the OU containing the affected objects, use Group Policy Results in GPMC to identify whether it is denied, unreadable, filtered, or applied but overridden; this is a scope/filtering problem rather than inheritance unless the link is actually on a parent OU.

1. Generate results without gpresult

On a management computer with Group Policy Management installed:

1. Open Group Policy Management (gpmc.msc).
2. Right-click Group Policy Results → Group Policy Results Wizard.
3. Select one affected computer and the affected signed-in user.
4. Complete the wizard.
5. In the report, locate the GPO under:
   • Computer Configuration Summary
   • User Configuration Summary
6. Check Applied GPOs, Denied GPOs, and the denial reason.

GPMC supports Resultant Set of Policy (RSoP) reporting specifically for diagnosing GPO interactions and deployment problems.^1^

Compare this with one working user/computer in the same OU. The difference between the two reports should identify the selective condition.

2. Apply the matching correction

If the result says Security Filtering or Access Denied

In GPMC → GPO → Scope → Security Filtering, verify that the affected user/computer—or a security group containing it—has permission to apply the GPO.

Then open Delegation → Advanced and check for an explicit Deny. Explicit deny overrides allow.

If Authenticated Users was removed to target only selected users, computer accounts must still be able to Read the GPO:

1. Open the GPO’s Delegation tab.
2. Select Add.
3. Add Domain Computers, Authenticated Users, or a group containing the affected computers.
4. Grant Read only—not Apply Group Policy—if those computers should merely retrieve a user-targeted GPO.
5. Keep Apply Group Policy assigned to the intended user security group.

Windows retrieves user policy using the computer context, so removing computer read access can prevent user settings from applying.^2^

If the result says WMI Filter: False

Open GPMC → WMI Filters, inspect the filter linked on the GPO’s Scope tab, and test its conditions against an affected and a working computer. A GPO applies only when its WMI filter evaluates to true on the destination computer.^3^

If one half of the GPO is disabled or empty

In GPMC → GPO Details, inspect GPO Status. Ensure it is not set to:

• User configuration settings disabled
• Computer configuration settings disabled
• All settings disabled

Also confirm that the relevant half actually contains configured settings. A GPO or either configuration section can be disabled independently.^3^

If the GPO is applied but the setting is wrong

Review Settings → Winning GPO in the results report. With several links on the same OU, the link with the lowest link-order number has precedence by default. Child-OU policies can override parent policies, while an Enforced parent link cannot be overridden by lower containers.^3^

Do not use Enforced merely to repair filtering or permissions; it changes precedence and does not make an otherwise inapplicable GPO apply.

If user settings are intended to follow the computer

Normally, user settings are selected from the user account’s OU, while computer settings are selected from the computer account’s OU. If users must receive particular settings only when signing in to selected computers, configure loopback processing:

Computer Configuration → Policies → Administrative Templates → System → Group Policy → Configure user Group Policy loopback processing mode

Use:

• Merge to append the computer-scoped user policies with higher precedence.
• Replace to use only user settings associated with the computer’s GPO scope.^3^

3. Refresh and inspect client processing

On an affected device, run from an elevated Command Prompt:

gpupdate /force /target:computer
gpupdate /force /target:user
gpresult /r

Computer policy is initially processed at startup and user policy at sign-in; some extensions, including software installation and folder redirection, require startup or sign-in rather than only a background refresh.^4^

If gpresult /h is unavailable, gpresult /r, /v, or /z can display RSoP in the console or redirect it to a text file.^5^

If results still do not show the reason:

1. Open Event Viewer.
2. Check Windows Logs → System for Group Policy warnings/errors.
3. Check Applications and Services Logs → Microsoft → Windows → GroupPolicy → Operational.
4. Compare the latest processing instance on an affected device with a working device.

The operational log lists applied and denied GPOs and records denial or processing details.^6^

References

1. Group Policy Management Console
2. Can't apply user Group Policy settings if computer objects don't have GPO Read permissions
3. Group Policy processing
4. Group Policy overview for Windows Server
5. gpresult
6. Applying Group Policy troubleshooting guidance