none
Group Policy Preferences - User Preferences not working

    Question

  • We are creating a new GPO in a Server 2012 environment, with Windows 7 and 8 clients.  The new policy contains both Computer and User Preferences. 

    They problem I'm running into is that when I run gpupdate /force on a client computer, the Computer Preferences are working, but not the User ones.

    There are no obvious errors.  Event Viewer says the policy was applied successfully; just no User Preferences.

    When I run gpresult, it lists Computer Policies and Preferences and User Policies, but User Preferences is missing.  I have User Preferences setup to add some registry keys into HKey Current User, as well as modifying the power plan.

    I've search all over the internet, with no luck on a fix. 

    Thanks,

    Monday, February 25, 2013 7:16 PM

Answers

  • Good news everyone!  I fixed it!

    Enabling Loopback Mode on my GPO fixed the problem.

    The GPO on our Users OU was over-writing the user configuration on my Computer OU.  I set Loopback mode to Merge the two instead of the User OU winning.

    Everything is working now.

    Thanks for the help!

    • Marked as answer by Neostad11 Monday, March 04, 2013 9:24 PM
    Monday, March 04, 2013 9:23 PM

All replies

  • Am 25.02.2013 20:16, schrieb Neostad11:
    >   Event Viewer says the policy was applied successfull
     
    For the user or for the computer? Open up GPMC.msc and create the RSOP
    HTML report from here - much more informative than the command line
    version...
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Monday, February 25, 2013 8:21 PM
  • Event Viewer doesn't specify.  That's the only message it says.

    All the RSOP report in GPMC tells me is the settings included in GPO.  It doesn't tell me whether it was successful or not.

    Monday, February 25, 2013 8:31 PM
  • Hi,

    Open GPMC, right click on "Group Policy Result" and choose "Group Policy Results Wizard" to generate a report by specifying the computer and user account, could you get some information on this report?

    Regards,
    Cicely

    Tuesday, February 26, 2013 6:34 AM
    Moderator
  • Am 25.02.2013 21:31, schrieb Neostad11:
    > Event Viewer doesn't specify.  That's the only message it says.
     
    Really? In my event log, I see the following:
     
    Completed periodic policy processing for computer CORP\DC1$ in 14 seconds.
    (Computer policy, Event ID 8006)
    Completed manual processing of policy for user CORP\admin in 3 seconds.
    (User policy, Event ID 8005)
     
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Tuesday, February 26, 2013 7:49 AM
  • Hi,

    Open GPMC, right click on "Group Policy Result" and choose "Group Policy Results Wizard" to generate a report by specifying the computer and user account, could you get some information on this report?

    Regards,
    Cicely


    Hello. 

    I ran the results wizard on a computer this policy is applied to.  Same issue.  It lists the computer policy and preferences, but only the user policy.  The user prefereces is missing.

    All my Event View says is "Security policy in the group policy objects has been applied successfully." No errors at all.

    Tuesday, February 26, 2013 2:24 PM
  • Am 26.02.2013 15:24, schrieb Neostad11:
    > All my Event View says is "Security policy in the group policy objects
    > has been applied successfully." No errors at all.
     
    Wrong event log ;-) You are looking at the application event log. GPO
    has its own eventlog starting with Vista.
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Tuesday, February 26, 2013 3:54 PM
  • Am 26.02.2013 15:24, schrieb Neostad11:
    > All my Event View says is "Security policy in the group policy objects
    > has been applied successfully." No errors at all.
    Wrong event log ;-) You are looking at the application event log. GPO
    has its own eventlog starting with Vista.

    Ah ok I see it now.  I didn't know that :)

    I'm getting the same messages of Completed periodic policy processing and Completed manual processing of policy.  No error messages, but the preferences are still missing.

    Tuesday, February 26, 2013 4:48 PM
  •  
    > Ah ok I see it now.  I didn't know that :)
     
    Now you do :D
     
    > I'm getting the same messages of Completed periodic policy processing
    > and Completed manual processing of policy.  No error messages, but the
    > preferences are still missing.
    >
     
    Strange thing. I suggest enabling gpsvc debug logging, then issuing
    "gpupdate /target:user" and then checking the gpsvc log for processed
    CSEs. No reboot required.
     
    *Value Path:* HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Diagnostics
    *Value Name:* GPSvcDebugLevel
    *Value Type:* REG_DWORD
    *Value Data:* 30002 (hex)
     
    *Output:* %windir%\debug\usermode\gpsvc.log (create the debug\usermode
    folder in advance...)
     
    (or just post the gpsvc.log contents...)
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Tuesday, February 26, 2013 8:03 PM
  • I scrolled through the log.  It listed all of the Polices, but none of the preferences.  No error messages for them; they just aren't there.

    Here is part of the log.  I only posted part of it, as it is quite long.

    GPSVC(550.1fd0) 14:13:01:702 ProcessGPOs(User): Processing extension Group Policy Regional Options
    GPSVC(550.1fd0) 14:13:01:702 CompareGPOLists:  The lists are the same.
    GPSVC(550.1fd0) 14:13:01:702 CompareGPOLists:  The lists are the same.
    GPSVC(550.1fd0) 14:13:01:702 CheckGPOs: No GPO changes but couldn't read extension Group Policy Regional Options's status or policy time.
    GPSVC(550.1fd0) 14:13:01:702 ProcessGPOs(User): Extension Group Policy Regional Options skipped because both deleted and changed GPO lists are empty.
    GPSVC(550.1fd0) 14:13:01:702 ProcessGPOs(User): -----------------------
    GPSVC(550.1fd0) 14:13:01:703 ProcessGPOs(User): Processing extension Group Policy Power Options
    GPSVC(550.1fd0) 14:13:01:703 CompareGPOLists:  The lists are the same.
    GPSVC(550.1fd0) 14:13:01:703 CompareGPOLists:  The lists are the same.
    GPSVC(550.1fd0) 14:13:01:703 CheckGPOs: No GPO changes but couldn't read extension Group Policy Power Options's status or policy time.
    GPSVC(550.1fd0) 14:13:01:703 ProcessGPOs(User): Extension Group Policy Power Options skipped because both deleted and changed GPO lists are empty.
    GPSVC(550.1fd0) 14:13:01:703 ProcessGPOs(User): -----------------------
    GPSVC(550.1fd0) 14:13:01:703 ProcessGPOs(User): Processing extension Audit Policy Configuration
    GPSVC(550.1fd0) 14:13:01:704 CompareGPOLists:  The lists are the same.
    GPSVC(550.1fd0) 14:13:01:704 CheckGPOs: No GPO changes but couldn't read extension Audit Policy Configuration's status or policy time.
    GPSVC(550.1fd0) 14:13:01:704 ProcessGPOs(User): Extension Audit Policy Configuration skipped with flags 0x610076.
    GPSVC(550.1fd0) 14:13:01:704 ProcessGPOs(User): -----------------------
    GPSVC(550.1fd0) 14:13:01:704 ProcessGPOs(User): Processing extension Group Policy Applications
    GPSVC(550.1fd0) 14:13:01:704 CompareGPOLists:  The lists are the same.
    GPSVC(550.1fd0) 14:13:01:704 CompareGPOLists:  The lists are the same.
    GPSVC(550.1fd0) 14:13:01:705 CheckGPOs: No GPO changes but couldn't read extension Group Policy Applications's status or policy time.
    GPSVC(550.1fd0) 14:13:01:705 ProcessGPOs(User): Extension Group Policy Applications skipped because both deleted and changed GPO lists are empty.
    GPSVC(550.1fd0) 14:13:01:705 ProcessGPOs(User): -----------------------
    GPSVC(550.1fd0) 14:13:01:705 ProcessGPOs(User): Processing extension Enterprise QoS
    GPSVC(550.1fd0) 14:13:01:705 CompareGPOLists:  The lists are the same.
    GPSVC(550.1fd0) 14:13:01:705 CheckGPOs: No GPO changes but couldn't read extension Enterprise QoS's status or policy time.
    GPSVC(550.1fd0) 14:13:01:705 ProcessGPOs(User): Extension Enterprise QoS skipped because both deleted and changed GPO lists are empty.
    GPSVC(550.1fd0) 14:13:01:706 ProcessGPOs(User): -----------------------
    GPSVC(550.1fd0) 14:13:01:706 ProcessGPOs(User): Processing extension CP
    GPSVC(550.1fd0) 14:13:01:706 CompareGPOLists:  The lists are the same.
    GPSVC(550.1fd0) 14:13:01:706 CheckGPOs: No GPO changes but couldn't read extension CP's status or policy time.
    GPSVC(550.1fd0) 14:13:01:706 ProcessGPOs(User): Extension CP skipped with flags 0x610076.
    GPSVC(550.1fd0) 14:13:01:706 GetFgPolicySettingImpl (bSync: 0)
    GPSVC(550.1fd0) 14:13:01:707 ProcessGPOs(User): No WMI logging done in this policy cycle.
    GPSVC(550.1fd0) 14:13:01:707 Application complete with bConnectivityFailure = 0.
    GPSVC(550.1fd0) 14:13:01:707 Signalling 1 Refresh Policy callers
    GPSVC(550.1fd0) 14:13:01:708 ProcessGPOs(User): Send a network deactivate for AOAC.
    GPSVC(550.1fd0) 14:13:01:708 Passive Network deactivated.
    GPSVC(550.1fd0) 14:13:01:708 UpdateWNFTrigger called : bMachine = 0, bEnableWNFTRigger = 0
    GPSVC(550.1fd0) 14:13:01:708 StartTaskScheduler status: 0x0
    GPSVC(550.1fd0) 14:13:01:711 UpdateWNFTrigger has 2 triggers to process.
    GPSVC(550.1fd0) 14:13:01:728 UpdateWNFTrigger succeeded.
    GPSVC(550.1fd0) 14:13:01:729 GPOThread(User): Waiting 0.
    GPSVC(3f4.1a78) 14:17:42:506 CGPNotify::OnNotificationTriggered: SetEvent = 0x2f8
    GPSVC(3f4.1a78) 14:17:42:510 CGPNotify::OnNotificationTriggered: SetEvent = 0x33c
    GPSVC(3f4.1a78) 14:17:42:513 CGPNotify::OnNotificationTriggered: SetEvent = 0x37c
    GPSVC(3f4.1a78) 14:17:42:518 CGPNotify::OnNotificationTriggered: SetEvent = 0x3bc
    GPSVC(ad0.2188) 14:18:11:983 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x5ac
    GPSVC(ad0.2188) 14:18:12:034 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(ad0.2188) 14:18:12:084 CGPNotify::RegisterForNotification: Entering with target User and event 0x274
    GPSVC(ad0.2188) 14:18:12:134 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(550.1e00) 14:19:24:116 CGPService::WaitForServiceInitialization: Beginning WaitForSingleObject.
    GPSVC(550.1e00) 14:19:24:116 CGPService::WaitForServiceInitialization: Completed WaitForSingleObject.
    GPSVC(550.1e00) 14:19:24:117 CGPApplicationService::IsALockInPlace.
    GPSVC(550.1e00) 14:19:24:117 CPolicyCriticalSectionCollection: Calling IsALockInPlace
    GPSVC(550.1e00) 14:19:24:117 CGPApplicationService::IsPolicyProcessingOnAnyThread.
    GPSVC(550.1e00) 14:19:24:117 PolicyApplicationState is False.
    GPSVC(550.1e00) 14:19:24:118 AsyncThreadsProcessing is False.
    GPSVC(550.1e00) 14:19:24:118 PolicyApplicationState is False.
    GPSVC(550.1e00) 14:19:24:118 AsyncThreadsProcessing is False.
    GPSVC(550.1e00) 14:19:24:118 PolicyApplicationState is False.
    GPSVC(550.1e00) 14:19:24:119 AsyncThreadsProcessing is False.
    GPSVC(550.1e00) 14:19:24:119 CGPApplicationService::IsAnEventProcessing.
    GPSVC(550.1e00) 14:19:24:119 CGPRPCService::HasOpenAPICallCount() Count is 0/0
    GPSVC(550.1e00) 14:19:24:119 CGPRPCService::GetServerCallCompleted() Calls completed 1
    GPSVC(550.1e00) 14:19:24:119 CGPRPCServerBase::TryIdleStop trying to stop RPC server
    GPSVC(550.1e00) 14:19:24:120 CGPRPCService::GetServerCallCompleted() Try Idle Stop 1
    GPSVC(550.1e00) 14:19:24:120 CGPService::IsServiceIdle: bPolicyProcessing=0. bEventProcessing=0. bLockInPlace= 0. bResult=1.
    GPSVC(550.1e00) 14:19:24:120 ServiceIdleTimerCallback: Service is idle; stopping.
    GPSVC(550.1e00) 14:19:24:120 Set Idle Stop Fired.
    GPSVC(550.1e00) 14:19:24:121 CGPService::SetServiceTerminatingEvent called.
    GPSVC(550.1c78) 14:19:24:121 CGPService::CleanupGPSubSystem RejectNewCallers()
    GPSVC(550.1c78) 14:19:24:121 CGPService::CleanupGPSubSystem GPUnRegisterForWinLogonEventNotification()
    GPSVC(550.1c78) 14:19:24:122 CGPEventSubSystem::GroupPolicyOnServiceStop fired.
    GPSVC(550.1c78) 14:19:24:123 CGPApplicationService::ServiceShutdownEvent fired.
    GPSVC(550.1c78) 14:19:24:123 CPolicyCriticalSectionCollection: Calling AbortWaitingCallers
    GPSVC(550.1c78) 14:19:24:123 CGPService::CleanupGPSubSystem GroupPolicyOnServiceStop()
    GPSVC(550.1c78) 14:19:24:124 CGPService::CleanupGPSubSystem StopRPCServer()
    GPSVC(550.1c78) 14:19:24:124 CGPService::CleanupGPSubSystem - Not waiting for network connectivity
    GPSVC(550.1c78) 14:19:24:125 CGPService::CleanupGPSubSystem StopSendingResourceReachableEvent()
    GPSVC(550.1c78) 14:19:24:125 CGPUserCollection::Uninitialize WaitForGroupPolicySessionThreadsToTerminate Starting.
    GPSVC(550.1c78) 14:19:24:126 WaitForGroupPolicySessionThreadsToTerminate() checked.
    GPSVC(550.1c78) 14:19:24:126 CGPUserCollection::Uninitialize WaitForGroupPolicySessionThreadsToTerminate Completed.
    GPSVC(550.1c78) 14:19:24:126 CGPUserCollection::Uninitialize WaitForGroupPolicySessionThreadsToTerminate Starting.
    GPSVC(550.1fd0) 14:19:24:127 GPOThread(User): lpGPOInfo->lpGPInfoHandle->dwExtnCount is 0.
    GPSVC(550.1c78) 14:19:24:127 CGPUserCollection::Uninitialize WaitForGroupPolicySessionThreadsToTerminate Completed.
    GPSVC(550.1c78) 14:19:24:128 CGPUserCollection::Uninitialize WaitForGroupPolicySessionThreadsToTerminate Starting.
    GPSVC(550.1c78) 14:19:24:128 WaitForGroupPolicySessionThreadsToTerminate() checked.
    GPSVC(550.1c78) 14:19:24:128 CGPUserCollection::Uninitialize WaitForGroupPolicySessionThreadsToTerminate Completed.
    GPSVC(550.1284) 14:19:24:129 GPOThread(Machine): Done waiting, shutdown
    GPSVC(550.1c78) 14:19:24:130 CGroupPolicySession::CleanupEnvironment: Completed WaitForSingleObject.
    GPSVC(550.1c78) 14:19:24:130 User group policy thread has terminated.
    GPSVC(550.1c78) 14:19:24:130 Waiting for user group policy thread to terminate.
    GPSVC(550.1c78) 14:19:24:131 CGroupPolicySession::CleanupEnvironment: Beginning WaitForSingleObject.
    GPSVC(550.1c78) 14:19:24:131 CGroupPolicySession::CleanupEnvironment: Completed WaitForSingleObject.
    GPSVC(550.1c78) 14:19:24:136 User group policy thread has terminated.
    GPSVC(550.1c78) 14:19:24:137 Waiting for machine group policy thread to terminate.
    GPSVC(550.1c78) 14:19:24:137 CGPService::KeepServiceAlive: Beginning WaitForSingleObject.
    GPSVC(550.1c78) 14:19:24:138 CGPService::KeepServiceAlive: Completed WaitForSingleObject.
    GPSVC(550.1c78) 14:19:24:138 machine group policy thread has terminated.
    GPSVC(550.1c78) 14:19:24:140 Deleting sidString <S-1-5-21-2164490792-2549475360-3834264004-1656>
    GPSVC(550.1c78) 14:19:24:141 Deleting machine
    GPSVC(550.b2c) 14:19:34:682 CGPNotify::RegisterForNotification: Entering with target Machine and event 0x19b8
    GPSVC(550.b2c) 14:19:34:682 CGPNotify::RegisterForNotification: Exiting with status = 0
    GPSVC(550.b2c) 14:30:15:685 CGPNotify::UnregisterNotification: Entering with event 0x19b8
    GPSVC(550.b2c) 14:30:15:685 CGPNotify::UnregisterNotification: Exiting with dwStatus = 0x0

    Tuesday, February 26, 2013 9:03 PM
  • We are some lines too far down in this log... We are interested in all entries looking like

    GPSVC(550.1fd0) 14:13:01:702 ProcessGPOs(User): Processing extension Group Policy Regional Options

    There has to be a line that logs the extension "Group Policy Registry". there are 43 of these extensions. Regional Options is number 38 on the list, Registry is number 27.

    http://evilgpo.blogspot.de/2012/11/guids-guids-guids.html contains a table of all of them as of today in their execution order. The same table can be found on other places in the net.


    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!

    Wednesday, February 27, 2013 9:04 PM
  • We are some lines too far down in this log... We are interested in all entries looking like

    GPSVC(550.1fd0) 14:13:01:702 ProcessGPOs(User): Processing extension Group Policy Regional Options

    There has to be a line that logs the extension "Group Policy Registry". there are 43 of these extensions. Regional Options is number 38 on the list, Registry is number 27.

    Hi.

    I found this error in the log:

    "Extension group policy registry skipped because both deleted and changed gpo lists are empty"

    I'm trying to search this error online, but not having much luck finding an answer.

    Friday, March 01, 2013 6:37 PM
  • It's not just that easy that you "by accident" disabled USER-part of the GPO you are trying to deploy?

    Check the state of the GPO


    --
    Goran Johansson
    http://gjohansson.com/blog

    Saturday, March 02, 2013 1:21 PM
  • It's not just that easy that you "by accident" disabled USER-part of the GPO you are trying to deploy?

    Check the state of the GPO


    --
    Goran Johansson
    http://gjohansson.com/blog


    I checked and both User and Computer are enabled.  The User policies are working fine; just not the preferences.
    Monday, March 04, 2013 2:14 PM
  • Are you using item-level targeting and therefore these settings are ruled out?

    If you use modelling inside GPMC can you see that these preferences should "hit" the user?


    --
    Goran Johansson
    http://gjohansson.com/blog

    Monday, March 04, 2013 3:54 PM
  • Are you using item-level targeting and therefore these settings are ruled out?

    If you use modelling inside GPMC can you see that these preferences should "hit" the user?


    --
    Goran Johansson
    http://gjohansson.com/blog


    I double checked and item level targetting is disabled.  I tried the policy on an XP box and the preferences worked perfectly.  They don't work in Windows 7 or 8 though.  Not sure why they are applied on Xp but not 7 or 8.  I don't have an OS WMI filter on the policy or anything that would restrict the OS.
    Monday, March 04, 2013 4:20 PM
  • Good news everyone!  I fixed it!

    Enabling Loopback Mode on my GPO fixed the problem.

    The GPO on our Users OU was over-writing the user configuration on my Computer OU.  I set Loopback mode to Merge the two instead of the User OU winning.

    Everything is working now.

    Thanks for the help!

    • Marked as answer by Neostad11 Monday, March 04, 2013 9:24 PM
    Monday, March 04, 2013 9:23 PM