none
Apply once and do not reapply- What exactly this GPO setting means?

    Question

  • Some inclredibly helpful person here posted this answer - 

    If the Apply once and do not reapply option is selected, it changes this behavior, so the preference extension applies the results of the preference item to the user or computer only once.

    however i must be too slow but i am not exactly sure what this ONLY ONCE mean :( Once ever? Or once per login session? Or once until something else happens?

    REALLY appreciate clear explanation of this GPO setting 

    Wednesday, March 2, 2016 9:02 PM

Answers

  • it's not "EVER".

    Yes, the GP CSE's do write to registry, to keep a record of "has been applied", but that includes the GPO version data.

    if the GPO is modified, the version data of the GPO is incremented, and so you can expect that the GPO will be re-processed when the client detects that it has previously applied version111 but the GPO now is version112.

    Also, if the client executes a gpupdate /force, this will cause the version check to be ignored and the GPO is re-processed regardless.

    "Apply once and do not reapply", causes GP Preferences to "act like classic GP", i.e. detect that a new GPO is scoped (compared to last time GP was processed), apply the policy settings, create a local record in registry that the GPList now includes the additional GPO, the version of that GPO, etc, and then, assume that nobody/nothing else will ever change those registry settings, so that GPO never needs to be re-applied (unless the GPO undergoes a revision by the GP admin person).

    Preferences (GPP), defaults to the opposite behaviour, i.e. re-write the registry settings every time GPP processes.

    You can change the behaviour of both classic GP and also GPP.


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Thursday, March 3, 2016 7:27 PM
  • Hi,

    so let me bing this for you:

    https://technet.microsoft.com/en-us/library/cc772371.aspx#BKMK_Apply

    Preference items are applied when Group Policy refreshes.

    • By default, the results of preference items are rewritten each time Group Policy refreshes. This ensures that the results of the preference items are consistent with what the administrator designated in the Group Policy object.
    • If the      Apply once and do not reapply   option is selected, it changes this behavior, so the preference extension applies the results of the preference item to the user or computer only once. This option is useful when you do not want the results of a preference item to reapply.

    Some detailed info can be found here:

    http://andywolf.com/gpo-preferences-apply-once-and-do-not-reapply/

    Regards

    Eric


    Microsoft MVP Cloud and Datacenter Management
    Microsoft Partner Technical Solutions Professional (P-TSP)
    --
    www.ericberg.de
    @ericberg_de
    --
    MCSE: Enterprise Devices and Apps | MCSE: Private Cloud | MCSE: Server Infrastructure | MCSE: Desktop Infrastructure

    Wednesday, March 2, 2016 9:09 PM

All replies

  • Hi,

    so let me bing this for you:

    https://technet.microsoft.com/en-us/library/cc772371.aspx#BKMK_Apply

    Preference items are applied when Group Policy refreshes.

    • By default, the results of preference items are rewritten each time Group Policy refreshes. This ensures that the results of the preference items are consistent with what the administrator designated in the Group Policy object.
    • If the      Apply once and do not reapply   option is selected, it changes this behavior, so the preference extension applies the results of the preference item to the user or computer only once. This option is useful when you do not want the results of a preference item to reapply.

    Some detailed info can be found here:

    http://andywolf.com/gpo-preferences-apply-once-and-do-not-reapply/

    Regards

    Eric


    Microsoft MVP Cloud and Datacenter Management
    Microsoft Partner Technical Solutions Professional (P-TSP)
    --
    www.ericberg.de
    @ericberg_de
    --
    MCSE: Enterprise Devices and Apps | MCSE: Private Cloud | MCSE: Server Infrastructure | MCSE: Desktop Infrastructure

    Wednesday, March 2, 2016 9:09 PM
  • Right, seen this. So does this mean one time EVER?

    Thanks 

    Wednesday, March 2, 2016 11:27 PM
  • Hi EugeT,

    As mentioned above. By default, the results of preference items are rewritten each time Group Policy refreshes in 90 minutes.

    For example, if you have configured Computer Configuration and check the Apply once and do not reapply, the policy will apply every time when computer restart.

    If you have configured User Configuration and check the Apply once and do not reapply, the policy will apply every time when user logon.

    In additional, when you run gpupdate /force, the policy will apply again.

    Best Regards,

    Jay


    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Thursday, March 3, 2016 8:49 AM
    Moderator
  • For example, if you have configured Computer Configuration and check the Apply once and do not reapply, the policy will apply every time when computer restart.

    If you have configured User Configuration and check the Apply once and do not reapply, the policy will apply every time when user logon.

    I believe this is incorrect. The 'Apply once and do not reapply' will only ever apply once to the user or computer assuming that the result was successful. It is stored in the registry under a FilterRunOnce. See this post for more info:
    https://social.technet.microsoft.com/Forums/windowsserver/en-US/1cadf689-093b-4409-ab74-b629ba5538ea/prefence-apply-once-counter?forum=winserverGP

    It should be noted that there is a bug in Windows 7 with this setting when it fails - basically it is never reapplied.
    https://support.microsoft.com/en-us/kb/2284538

    • Edited by zxxzxx Thursday, March 3, 2016 12:51 PM
    Thursday, March 3, 2016 12:46 PM
  • Ok so.... EVER seems to be the right answer as far as i am understanding it. 

    Looks like it writes to the registry that it has had ran and that prevents it from doing so again. 

    Thursday, March 3, 2016 5:19 PM
  • it's not "EVER".

    Yes, the GP CSE's do write to registry, to keep a record of "has been applied", but that includes the GPO version data.

    if the GPO is modified, the version data of the GPO is incremented, and so you can expect that the GPO will be re-processed when the client detects that it has previously applied version111 but the GPO now is version112.

    Also, if the client executes a gpupdate /force, this will cause the version check to be ignored and the GPO is re-processed regardless.

    "Apply once and do not reapply", causes GP Preferences to "act like classic GP", i.e. detect that a new GPO is scoped (compared to last time GP was processed), apply the policy settings, create a local record in registry that the GPList now includes the additional GPO, the version of that GPO, etc, and then, assume that nobody/nothing else will ever change those registry settings, so that GPO never needs to be re-applied (unless the GPO undergoes a revision by the GP admin person).

    Preferences (GPP), defaults to the opposite behaviour, i.e. re-write the registry settings every time GPP processes.

    You can change the behaviour of both classic GP and also GPP.


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Thursday, March 3, 2016 7:27 PM
  • Thanks for clarifying, Don. I forgot to mention the point regarding GP's being updated in which case they are reprocessed.
    Thursday, March 3, 2016 7:47 PM
  • For example, if you have configured Computer Configuration and check the Apply once and do not reapply, the policy will apply every time when computer restart.

    If you have configured User Configuration and check the Apply once and do not reapply, the policy will apply every time when user logon.

    In additional, when you run gpupdate /force, the policy will apply again.

    Best Regards,

    Jay


    This is an incorrect statement.  If "Apply once and do not reapply" is selected, the policy is applied one time only and the policy GUID is written to the registry.  Each time the computer is rebooted, a user logs on, or gpupdate /force is ran, the registry is checked and if those GUID's are present and match the policy, the policy will not refresh.  The only way to have the policy reapply after the first time is to change the GUID - which you can do by unchecking the "Apply once and do not reapply" checkbox, click Apply and then check the "Apply once and do not reapply" box again and then save the policy.
    Tuesday, May 24, 2016 3:50 PM