GPO Troubleshouting

---

Hello to Everyone

I ran a gpresult on the affected computers but frankly I can't interpret all the data. What caught my eye is the fact in the initial summary gives me NO Error Detected but:

• I have many GPO Alerts with AD / SYSVOL Version Mismach. Could it be a problem?

• During the last IT policy request it gives me today's date but Last User Policy Update gives me a date more than a year ago (June 2019). By chance does it mean that on the user side this policy has not been updated since June 2019 or does it simply refer to the previous date, on which the user had logged and got the gpo updated? ie if I login to that machine now, will I get today's date as Last User Policy refresh?

Can you also tell me if in the Group Policy Management Console the tree that start from Group Policy Object contain all the possible gpo? This is because when I run Group Policy Result on a specific machine / user it gives me some policies applied on a user side that I just can't find of Group Policy Management/Group Policy Object.
Specifically this applied "invisible" gpo give me a link location that now it does not exist anymore in Active Directory

apart gpupdate /force, that does not work, there is other way to reset completely the Domain Policy applied?

Thanks for the help*

@Giovanni-Baldi ,

For gpresult, what version of Windows are the clients running? Are you using gpresult to target a remote machine? If so, what version of Windows is the local machine running (where you are running gpresult)?

Where are you seeing the Last User Policy Update? I would think that represented the last time the policy was changed, not applied.

All GPOs should appear in the GPMC. I haven't heard of the 'invisible GPO" before, I will try to do some research on that. Could you post a screenshot of the gpresults? As for resetting the Domain Policy applied, the list of GPOs is created dynamically during the update cycle (startup, logon, refresh, etc) so there isn't anything to reset.

The Client are Windows 10 and Windows 7 and the server is Windows Server 2012R2.

I've tried to run gpresult locally and from the Group Policy Management Console but the SYSVOL version Mismatch alert was only running from the GPMC to a remote Machine.

I'm not having full access to it. I.E some of the policies are showed Inaccessible for me in the GPMC. So yesterday i asked a colleague to open gpmc with his admin account and i wasn't able to find this policy in the Group Policy Object, but the folder associates still exist in the SYSVOl Folder, even if i don't have access to that folder, while i have access to other policies folder, but maybe this is related only to my account.

The AD structured was modified moving some computer to a new OU, this "ghost GPO" is showed in the RSoP generated and it seems to be linked to the old OU, that does't not exist anymore.

I'm very confused...however, just to improve i'm watching your Windows 2012 Course

@Giovanni-Baldi ,

The "AD / SYSVOL version mismatch" is a known issue with Windows 8.1 and Server 2012R2. There was a patch included in the May 2014 rollup from Microsoft. You can also obtain the stand-alone update package through the Microsoft Download Center. For more information, go to the Microsoft Download Center, and then search for KB2919394. (https://www.microsoft.com/en-us/download/details.aspx?id=41814)

Very strange with the hidden GPO. But without full access, I wouldn't know where to start. I would hate to tell you to try something, only to find out it was just a permission issue. I can say deleting an OU does not delete the GPOs linked to it, only the links themselves. The GPO will remain in the Group Policy Objects folder.

Hello Mike

About the strange behaviour, with the hidden GPO i found it only Running RSoP and only for my Domain Account that is an Account with some priviledge but not a full Domain Admin Account.

If i use the regular account of the user, at least i don't see this "hidden" GPO, applied or denied.

There is an additional GPO that i don't know why is not applied. This gpo is appeared in the Group Policy Inheritance on the OU, and it should be applied, but if i run the RSoP it seems it does not exist. it is not in the denied or approved policies.

This policy has a Security Filtering with a list of computer name written like this:

Computer_win10$(Domain\Computer_win10$)
Computer_win7_1$(Domain\Computer_win7_1$)
Computer_win7_2$(Domain\Computer_win7_2$)

plus a WMI Filtering that should select only the Computer with Windows 10

So the GPO should be applied to the list of computer in the security Filtering, but the only one with Windows 10.

select * from Win32_OperatingSystem where Version like "10.%" and ProductType="1"

Now this policy is NOT APPLIED in the Windows 7 Computer, appeared in the RSoP as Denied Policy, and it is correct for me

I was expecting to be applied in the Windows 10 Computer? But other not to being applied, seems not to have been processed because it does not appear in the RSoP. either as an applied policy or as a denied policy.

I also noticed that what I called hidden policy has the same GUID of the GPO i was mentioning now. It is normal? I mean different name but same GUID

I'm a bit confused :-|