none
Sub OU GP not being propagated

    Question

  • I have various Group Policies for each OU.   However only the top level Policies are being deployed.   Non of the sub OUs are being deployed.

    For Example.

    Contoso.com

     --->Group Policy 1

     --->Group Policy 1

     OU- United States

    ---- Group Policy 3

    Group Policy 3 would not get ran.


    Robert

    Wednesday, March 15, 2017 7:06 PM

Answers

  • Hi Robert,

    First, I suggest you check if the top level GPO was configured "Enforced". Right-click the top level GPO to check like below.

    And you need check if the GPO link to sub OUs was configure "link enable".

    If above all are ok, I suggest you try to run gpresult /h gpreport.html to troubleshooting. And please post the report to us for further research.

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Robert J W Monday, March 20, 2017 11:12 AM
    Thursday, March 16, 2017 2:22 AM
    Moderator
  • > So what is the right way for the GP for a specific OU
     
    Do not enforce high level GPOs.
     
    • Marked as answer by Robert J W Tuesday, March 21, 2017 11:16 AM
    Friday, March 17, 2017 8:37 AM

All replies

  • Hi Robert,

    First, I suggest you check if the top level GPO was configured "Enforced". Right-click the top level GPO to check like below.

    And you need check if the GPO link to sub OUs was configure "link enable".

    If above all are ok, I suggest you try to run gpresult /h gpreport.html to troubleshooting. And please post the report to us for further research.

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    • Marked as answer by Robert J W Monday, March 20, 2017 11:12 AM
    Thursday, March 16, 2017 2:22 AM
    Moderator

  • So the top level  6 Policies apply.    But the policies under Computer Kiosk do not.

    Robert


    • Edited by Robert J W Thursday, March 16, 2017 2:29 PM
    Thursday, March 16, 2017 12:57 PM

  • Robert

    Thursday, March 16, 2017 1:01 PM

  • Robert

    Thursday, March 16, 2017 1:01 PM

  • Robert

    Thursday, March 16, 2017 1:02 PM

  • Robert

    Thursday, March 16, 2017 1:02 PM

  • Robert

    Thursday, March 16, 2017 1:02 PM

  • Robert

    Thursday, March 16, 2017 1:02 PM
  • You are aware that enforcing GPOs changes processing order? First, enforced Sub GPOs are applied, then GPOs from higher OUs and the domain...
     
    It is - and was forever - really bad practice to enforce a GPO. It is even worse to enforce all of them, which makes it impossible to revert settings at a lower OU.
     
    Thursday, March 16, 2017 4:35 PM
  • Either way, it's not enforcing the lower OU, thus my problem

    Robert

    Thursday, March 16, 2017 5:08 PM
  • > Either way, it's not enforcing the lower OU, thus my problem
     
    Yes because the higher OU GPOs are already enforced - they will always win.
     
    Thursday, March 16, 2017 5:40 PM
  • So what is the right way for the GP for a specific OU

    Robert

    Thursday, March 16, 2017 7:03 PM
  • > So what is the right way for the GP for a specific OU
     
    Do not enforce high level GPOs.
     
    • Marked as answer by Robert J W Tuesday, March 21, 2017 11:16 AM
    Friday, March 17, 2017 8:37 AM
  • Hi,

    Are there any updates?

    If the above reply has resolved your problem, please mark it as answer.

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, March 20, 2017 8:27 AM
    Moderator