Sign in
 

none
GPO (Computer Setting) not applied when Security Filtering for specific user.

 > 

    Question

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hello,

    DCs: Windows 2008 Standard
    Clients: Windows 7 Pro

    I have a GPO linked at domain level with the policy "Network access: Do not allow storage of passwords and credentials for network authentication" enabled, so any computer stores passwords on disk.

    By other side another GPO linked specifically in one OU disables the same policy for one computer inside. This GPO works well when Security Filtering is applied for Authenticated Users but doesn't when is applied just for one user.

    Using "gpresult /r" seems like acces is denied for the GPO:

    Los objetos GPO siguientes no se aplicaron porque fueron filtrados
    -------------------------------------------------------------------
        DisableDontStorePasswordOnDisk
            Filtrar:  Denegado (Seguridad)


    And this is the related gpsvc.log debug log:

    GPSVC(338.6e0) 03:38:48:940 ProcessGPO:  Searching <cn={D0FF01FA-1EDD-458C-B678-7E02BEFCDC33},cn=policies,cn=system,DC=domain,DC=local>
    GPSVC(338.6e0) 03:38:48:940 ProcessGPO:  Machine does not have access to the GPO and so will not be applied.
    GPSVC(338.6e0) 03:38:48:940 ProcessGPO:  Found functionality version of:  2
    GPSVC(338.6e0) 03:38:48:940 ProcessGPO:  Found file system path of:  <\\domain.local\SysVol\domain.local\Policies\{D0FF01FA-1EDD-458C-B678-7E02BEFCDC33}>
    GPSVC(338.6e0) 03:38:48:940 ProcessGPO:  Sysvol access skipped because GPO is not getting applied or is not needed.
    GPSVC(338.6e0) 03:38:48:940 ProcessGPO:  Found common name of:  <{D0FF01FA-1EDD-458C-B678-7E02BEFCDC33}>
    GPSVC(338.6e0) 03:38:48:940 ProcessGPO:  Found display name of:  <DisableDontStorePasswordOnDisk>
    GPSVC(338.6e0) 03:38:48:940 ProcessGPO:  Found machine version of:  GPC is 5, GPT is 65535
    GPSVC(338.6e0) 03:38:48:940 ProcessGPO:  Found flags of:  0
    GPSVC(338.6e0) 03:38:48:940 ProcessGPO:  Found extensions:  [{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{827D319E-6EAC-11D2-A4EA-00C04F79F83A}{803E14A0-B4FB-11D0-A0D0-00A0C90F574B}]

    I double checked that Authenticated Users have "Read" permissions and the specific user have "Read" and "Apply group policy" in "Advanced" configuration in "Delegation" tab.

    I also tried enabling "Configure user Group Policy loopback processing mode" policy but like his name suggest it works for User Settings and "Network access: Do not allow storage of passwords and credentials for network authentication" policy is a Computer Setting.

    Thanks for your help.

    Wednesday, July 20, 2016 10:16 AM
    |

Answers

  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I double checked that Authenticated Users have "Read" permissions and the specific user have "Read" and "Apply group policy" in "Advanced" configuration in "Delegation" tab.

    >>>Try to delegate Domain computers with Read permission in GPO.

    Best Regards,

    Jay

    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Wednesday, July 27, 2016 6:52 AM
    |
    Moderator

All replies

  • Question
    Sign in to vote
    0
    Sign in to vote
    > By other side another GPO linked specifically in one *OU* disables the
    > same policy for one computer inside. This GPO works well when *Security
    > Filtering* is applied for *Authenticated Users* but doesn't when is
    > applied just for one user.
     
    Welcome to the shiny new GPO world after the release of MS16-072 :)
     
    Wednesday, July 20, 2016 10:42 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    information about this "behavior" is available at https://blogs.technet.microsoft.com/askpfeplat/2016/07/05/who-broke-my-user-gpos/ 

    Regards

    Daniel

    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

    Wednesday, July 20, 2016 11:10 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    > By other side another GPO linked specifically in one *OU* disables the
    > same policy for one computer inside. This GPO works well when *Security
    > Filtering* is applied for *Authenticated Users* but doesn't when is
    > applied just for one user.
     
    Welcome to the shiny new GPO world after the release of MS16-072 :)
     

    Hi,

    Thanks for your reply.

    Last update on my DCs was in May so I think is not the case. I also verified that update 3159398 isn't installed on any DC.

    Wednesday, July 20, 2016 3:31 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    if you installed ms16-07 patch then you should give read permission to authenticated user

    http://www.windowstricks.in/2016/06/group-policy-not-applyingworking-patching-gpo-permission-issues.html

    Regards www.windowstricks.in

    Wednesday, July 20, 2016 7:07 PM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    Thanks for your post.

    I suggest you run the command gpresult /h C:\gpresult.html with administrative permission and post it to us for further research.

    Here is a similar thread below to fix the problem by dis-join and re-join domain.

    https://social.technet.microsoft.com/Forums/en-US/7386c979-1766-41d2-b404-8224bb9b7b8a/gpo-not-applied-to-some-windows-7-machines?forum=winserverGP

    Best Regards,

    Jay

    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Thursday, July 21, 2016 6:21 AM
    |
    Moderator
  • Question
    Sign in to vote
    0
    Sign in to vote
    > Last update on my DCs was in May so I think is not the case. I also
    > verified that update 3159398 isn't installed on any DC.
     
    Nobody mentionend DCs - it's all about clients...
     
    Thursday, July 21, 2016 9:38 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    if you installed ms16-07 patch then you should give read permission to authenticated user

    http://www.windowstricks.in/2016/06/group-policy-not-applyingworking-patching-gpo-permission-issues.html

    Regards www.windowstricks.in

    Hi,

    Thanks for your reply.

    I already did it. Both, Authenticated Users and Domain Computers have Read permissions and specific user have Read and Apply group policy permissions:

    Thursday, July 21, 2016 11:15 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    Thank you for your reply.

    I have tried rejoining the domain without success.

    Below you will find the gpresult output. The file is in spanish, sorry for the inconvenience. I can translate for you if you have trouble understanding.

    Thanks in advance

    Resultados de directivas de grupo
    DOMAIN\specific_user en DOMAIN\CLIENT_W7
    Datos recopilados el: 21/07/2016 12:09:48
    Resumen
    Resumen de la configuración del equipo
    General
    Nombre de equipo DOMAIN\CLIENT_W7
    Dominio domain.local
    Sitio Default-First-Site-Name
    Última vez que se procesó la directiva de grupo 21/07/2016 12:09:15
    Objetos de directiva de grupo
    GPO aplicados
    Nombre Ubicación de vínculo Revisión
    DontStorePasswordsOnDisk domain.local AD (4), Volumen del sistema (4)
    Default Domain Policy domain.local AD (3), Volumen del sistema (3)
    GPOs denegados
    Nombre Ubicación de vínculo Causa denegada
    Directiva de grupo local Local Vacío
    DisableDontStorePasswordOnDisk domain.local/Ordenadores Acceso denegado (filtrado de seguridad)
    Pertenencia a grupos de seguridad cuando se aplicó la directiva de grupo
    BUILTIN\Administradores
    Todos
    BUILTIN\Usuarios
    NT AUTHORITY\NETWORK
    NT AUTHORITY\Usuarios autentificados
    NT AUTHORITY\Esta compañía
    DOMAIN\CLIENT_W7$
    DOMAIN\Domain Computers
    Identidad afirmada de la autoridad de autenticación
    Etiqueta obligatoria\Nivel obligatorio del sistema
    Filtros WMI
    Nombre Valor Objetos GPO de referencia
    Ninguno
    Estado del componente
    Nombre del componente Estado Última hora de proceso
    Infraestructura de directivas de grupo Correcto 21/07/2016 12:09:17
    Registro Correcto 21/07/2016 12:09:16
    Security Correcto 21/07/2016 12:09:17
    Resumen de la configuración del usuario
    General
    Nombre de usuario DOMAIN\specific_user
    Dominio domain.local
    Última vez que se procesó la directiva de grupo 21/07/2016 12:09:15
    Objetos de directiva de grupo
    GPO aplicados
    Nombre Ubicación de vínculo Revisión
    Ninguno
    GPOs denegados
    Nombre Ubicación de vínculo Causa denegada
    Directiva de grupo local Local Vacío
    DontStorePasswordsOnDisk domain.local Vacío
    Default Domain Policy domain.local Vacío
    Pertenencia a grupos de seguridad cuando se aplicó la directiva de grupo
    DOMAIN\Domain Users
    Todos
    BUILTIN\Administradores
    BUILTIN\Usuarios de escritorio remoto
    BUILTIN\Usuarios
    NT AUTHORITY\Inicio de sesión remoto interactivo
    NT AUTHORITY\INTERACTIVE
    NT AUTHORITY\Usuarios autentificados
    NT AUTHORITY\Esta compañía
    LOCAL
    DOMAIN\Domain Admins
    Identidad afirmada de la autoridad de autenticación
    DOMAIN\Denied RODC Password Replication Group
    Etiqueta obligatoria\Nivel obligatorio alto
    Filtros WMI
    Nombre Valor Objetos GPO de referencia
    Ninguno
    Estado del componente
    Nombre del componente Estado Última hora de proceso
    Infraestructura de directivas de grupo Correcto 21/07/2016 12:09:16
    Configuración del equipo
    Directivas
    Configuración de Windows
    Configuración de seguridad
    Directivas de cuenta/Directiva de contraseñas
    Directiva Configuración GPO prevalente
    Almacenar contraseñas usando cifrado reversible Deshabilitado Default Domain Policy
    Exigir historial de contraseñas 24 contraseñas recordadas Default Domain Policy
    Las contraseñas deben cumplir los requisitos de complejidad Habilitado Default Domain Policy
    Longitud mínima de la contraseña 7 caracteres Default Domain Policy
    Vigencia máxima de la contraseña 42 días Default Domain Policy
    Vigencia mínima de la contraseña 1 días Default Domain Policy
    Directivas de cuenta/Directiva de bloqueo de cuenta
    Directiva Configuración GPO prevalente
    Umbral de bloqueo de cuenta 0 intentos de inicio de sesión no válidos Default Domain Policy
    Directivas locales/Opciones de seguridad
    Acceso a la red
    Directiva Configuración GPO prevalente
    Acceso a redes: no permitir el almacenamiento de contraseñas y credenciales para la autenticación de la red Habilitado DontStorePasswordsOnDisk
    Acceso de red: permitir traducción SID/nombre anónima Deshabilitado Default Domain Policy
    Seguridad de red
    Directiva Configuración GPO prevalente
    Seguridad de red: forzar el cierre de sesión cuando expire la hora de inicio de sesión Deshabilitado Default Domain Policy
    Seguridad de red: no almacenar valor de hash de LAN Manager en el próximo cambio de contraseña Habilitado Default Domain Policy
    Directivas de clave pública/Cliente de Servicios de servidor de certificados: configuración de inscripción automática
    Directiva Configuración GPO prevalente
    Administración automática de certificados Habilitado [Configuración predeterminada]
    Opción Configuración
    Inscribir nuevos certificados, renovar certificados expirados, procesar solicitudes de certificado pendientes y quitar certificados revocados Deshabilitado
    Actualizar y administrar certificados que usen plantillas de certificado de Active Directory Deshabilitado
    Directivas de clave pública/Sistema de cifrado de archivos (EFS)
    Certificados
    Emitido para Emitido por Fecha de expiración Propósitos planteados GPO prevalente
    Administrator Administrator 17/05/2115 18:43:42 Recuperación de archivos Default Domain Policy

    Para obtener información adicional sobre la configuración individual, abra el Editor de objetos de directiva de grupo.
    Directivas de clave pública/Entidades de certificación raíz de confianza
    Propiedades
    GPO prevalente [Configuración predeterminada]
    Directiva Configuración
    Permitir a los usuarios seleccionar nuevas entidades de certificación raíz de confianza Habilitado
    Los equipos cliente pueden confiar en los siguientes almacenes de certificados Entidades de certificación raíz de terceros y entidades de certificación raíz de empresa
    Para realizar la autenticación de usuarios y equipos basada en certificados, las CA deben cumplir los siguientes criterios Sólo los registrados en Active Directory
    Plantillas administrativas
    Error al recopilar datos para Plantillas administrativas.
    Se produjeron los siguientes errores:
    No se pudo encontrar el recurso "$(string.Advanced_EnableSSL3Fallback)" al que se hace referencia en el atributo displayName. Archivo C:\Windows\PolicyDefinitions\inetres.admx, línea 795, columna 308
    Configuración de usuario
    Configuración no definida.

    • Edited by alllearn Thursday, July 21, 2016 11:32 AM uncorrect format
    Thursday, July 21, 2016 11:30 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote
    > Last update on my DCs was in May so I think is not the case. I also
    > verified that update 3159398 isn't installed on any DC.
     
    Nobody mentionend DCs - it's all about clients...
     

    Hi,

    Thanks for your answer.

    As still not working despite great link provided by RabanserDI thought it was because the update 3159398 isn't installed on DCs.

    Anyway, it still doesn't work.

    Thanks again.

    Thursday, July 21, 2016 11:39 AM
    |
  • Question
    Sign in to vote
    0
    Sign in to vote

    Hi,

    I double checked that Authenticated Users have "Read" permissions and the specific user have "Read" and "Apply group policy" in "Advanced" configuration in "Delegation" tab.

    >>>Try to delegate Domain computers with Read permission in GPO.

    Best Regards,

    Jay

    Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.


    Wednesday, July 27, 2016 6:52 AM
    |
    Moderator