none
Group Policies 'inaccessible' using any security filtering group other than Authenticated Users.

    Question

  • Hi all,

    Am struggling to find an answer to this this. Basically any group policy we have a security filter on that isn't "Authenticated Users" is showing up as 'Inaccessible' when I run a gpresult.

    All the highlighted polices use custom security groups for filtering. All the others use 'Authenticated Uses' and work as expected.

    It also illustrates that all these policies are applied to our [domain]\Sites OU which contains all our user and computer accounts.

    If i change any working policy to a custom security group, it becomes inaccessible straight away, and vise versa with broken policy's.

    Looking at the permissions of both SYSVOL and the AD objects, they all look correct.

    Any guidance or suggestions for trying to isolate this issue would be greatly appreciated.

    UPDATE: It also seems to just relate to user filtering. In the screenshot above, the 2 GPOs that are 'Access Denied (Security Filtering)' are filtered based on computer accounts.


    • Edited by Riceman85 Monday, August 29, 2016 3:46 AM Update
    Monday, August 29, 2016 3:38 AM

Answers

  • Solved this with some more searching of the interwebs.

    https://support.microsoft.com/en-us/kb/3163622

    Microsoft changed the way user based group polices are retrieved. 

    From now on I'll have to add the 'Domain Computers' group read delegation rights to any user based policy I choose to filter on user groups.

    • Marked as answer by Riceman85 Monday, August 29, 2016 3:59 AM
    Monday, August 29, 2016 3:58 AM

All replies

  • Solved this with some more searching of the interwebs.

    https://support.microsoft.com/en-us/kb/3163622

    Microsoft changed the way user based group polices are retrieved. 

    From now on I'll have to add the 'Domain Computers' group read delegation rights to any user based policy I choose to filter on user groups.

    • Marked as answer by Riceman85 Monday, August 29, 2016 3:59 AM
    Monday, August 29, 2016 3:58 AM
  • Hi,

    Thanks for your posting here and sharing the resolution in the forum as it would be helpful to anyone who encounters similar issues.

    If there is anything else we can do for you, please feel free to post in the forum.

    Best Regards,

    Alvin Wang


    Please remember to mark the replies as an answers if they help and unmark them if they provide no help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, August 29, 2016 5:44 AM
    Moderator