Group Policy

OU and link design

Link GPOs where the target objects live. Separate user and computer OUs when the setting model is different, and keep baseline GPOs broad while making application or department policy narrow.

Security filtering

Security filtering depends on Read and Apply Group Policy permissions. If Authenticated Users is removed, make sure the computer account can still read the GPO or the client may never evaluate it.

WMI filtering

WMI filters evaluate on the target computer during processing. Keep filters simple and fast. Slow or broken WMI queries can delay logon and make a valid GPO look like it disappeared.

Enforced and block inheritance

Enforced is a link setting that prevents lower containers from overriding that GPO. Block inheritance is a container setting that stops normal inherited links, but it does not stop enforced links.

User vs computer side

Computer Configuration only applies to computers, and User Configuration only applies to users. A GPO can be linked correctly but still do nothing if the wrong side is disabled or the wrong object type is targeted.

Loopback processing

Loopback applies user policy based on the computer object. Use Merge for adding computer-scoped user policy and Replace for shared devices where the computer location should fully control user settings.

Start with gpresult /h

Run gpresult /h C:\Temp\gpresult.html from an elevated prompt for computer policy, and as the affected user for user policy. Check Applied GPOs, Denied GPOs, security filtering, WMI filter results, and winning settings.

Use RSoP for visual inspection

rsop.msc is useful when you need a quick MMC view of applied Administrative Template and security settings. It is less complete than gpresult, so use both when diagnosing complex scope issues.

Read Event Viewer

Check Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational. Extension timing, WMI filter failures, inaccessible OUs, and SYSVOL read issues usually surface here.

Separate scope from application

If the GPO appears under Denied GPOs, fix OU, link, security, or WMI targeting. If it appears under Applied GPOs but the setting is missing, investigate the specific client-side extension and setting path.

Check domain controller and SYSVOL path

gpresult shows the domain controller used. Confirm the client can resolve and reach that DC, read SYSVOL, and see the expected policy version after AD and DFSR replication complete.

Do not rely on gpupdate alone

gpupdate /force reruns policy processing, but repeated refreshes hide the real problem. Capture gpresult and the GroupPolicy Operational log before and after the refresh so you can compare what changed.