Group Policy Processing and MS16-072
Today I'll talk about a change in the group policy processing design that troubled me today. I created a new GPO, configured the settings and the security filtering in order to restrict it to a test users group and then linked in to the domain. The policy however did not apply to all of the users in security group. I started by running gpresult in order to get the status of the GPO for the users on their computers. The GPO was inaccessible. I then double checked the permissions on the GPO just to make sure that the filtering has applied the correct permissions and that there were no deny permissions. Everything was good so far. I fired up the event viewer on the client computer in order to check the events regarding the group policy processing but there were not events regarding my GPO. After a quick check on the SYSVOL and ADSIEdit, I decided to focus on the client side since the GPO applied to some of the users in the security group and discovered the following. Recently, the...