Group Policy processing

Begin with the affected user and computer

Run the report on the machine with the problem, in the affected user’s session. You’ll commonly need elevation for computer-scope information. If you elevate as a different account, make sure you haven’t produced the report for the wrong user.

gpresult /h gpresult.html
gpresult /r /scope computer
gpresult /r /scope user
gpresult /z > gpresult-detail.txt

Check whether the expected GPO is applied, denied, or absent. Keep the DC used and processing time with the report. gpresult shows resultant policy information, not a live trace of the failure. See the gpresult reference.

Follow scope before changing settings

The usual order is local, site, domain, then nested OUs. Later applicable settings generally win, but link order, enforced links, inheritance blocking, and extension-specific behavior all matter.

One GPO can have one WMI filter; the filter can be shared by multiple GPOs. A slow or incorrect query can affect policy processing. The processing guide explains the hierarchy, filtering, and loopback rules.

Loopback changes where user settings come from

Loopback is configured for a computer and affects user policy on that computer. It is useful for shared or tightly controlled machines.

In merge mode, the user’s ordinary GPO list is supplemented by the user settings from the computer’s GPO list, with those later settings taking precedence when they conflict. In replace mode, the user’s ordinary list is replaced by the computer-based list for user settings. It does not apply the computer configuration section as user policy.

When only users on a particular machine behave differently, check loopback before editing their user OU policy.

A GPO has two replicated halves

The Group Policy Container is in AD; the Group Policy Template is in SYSVOL. AD replication carries the first, while DFSR carries the files in current domains. The gPLink attributes live on the scope-of-management objects, not on a policy object simply because it is linked there.

When behavior varies by DC, compare that DC’s AD copy and SYSVOL files. GPO versions have separate user and computer components. Seeing the policy object in AD doesn’t tell you whether its files arrived. The Group Policy structure specification explains the model.

The extension determines how a setting applies

Client-side extensions process different types of settings. Some need foreground or synchronous processing; others work in the background. A forced refresh can’t always replace logoff, logon, or restart. Check the setting and extension’s requirements before deciding gpupdate failed.

Preferences can leave a setting behind after an item stops applying, depending on the item and removal options. “Replace” and “Update” also differ: for local group membership, a replace-style operation can remove memberships that an administrator expected to retain. Review the actual action, item-level targeting, and removal behavior. See the Group Policy Preferences model.

Correlate the processing instance

Use Microsoft-Windows-GroupPolicy/Operational and follow events with the same ActivityID. Find the slow or failing phase/extension, then check its inputs. System/Application events often give the overall result; the operational channel shows the sequence. See Group Policy troubleshooting.

Inspect link precedence without calling it resultant policy

$inheritance = Get-GPInheritance -Target 'OU=Workstations,DC=contoso,DC=com' `
    -Domain 'contoso.com' -Server 'DC1.contoso.com'
$inheritance | Select-Object GpoInheritanceBlocked
$inheritance.GpoLinks |
    Select-Object DisplayName, Enabled, Enforced, Order
$inheritance.InheritedGpoLinks |
    Select-Object DisplayName, Enabled, Enforced, Order

GpoLinks shows links at that scope; inherited links show inheritance and precedence. This doesn’t evaluate the user’s security token, the computer’s WMI result, loopback, or each extension’s behavior. Use it to understand the candidate list, then compare gpresult on the client. The inheritance cmdlet documents the two collections.

At the same scope, link order 1 has the highest precedence. Inheritance blocking does not block an enforced link from above. An enforced setting higher in the hierarchy can therefore survive a conflicting lower-level setting. Record both the location and link options when explaining the winner; “the closest OU always wins” is incomplete. See Set-GPLink’s ordering rules.

Decode a version without treating it as a file hash

The 32-bit GPO version packs the user component in the upper 16 bits and the computer component in the lower 16 bits. Inspect the relevant half when only user or computer behavior differs. GPO PowerShell objects also expose user/computer version details:

$gpo = Get-GPO -Name 'Workstation baseline' -Domain 'contoso.com' `
    -Server 'DC1.contoso.com'
$gpo.User | Format-List *
$gpo.Computer | Format-List *

Compare the directory and SYSVOL versions on the same DC, then repeat against another replica. Equal counters don’t mean every policy file has the same hash. A mismatch points to replication or an incomplete edit; manually changing counters can hide the problem without fixing it. See Get-GPO and the GPO structure specification.

Background refresh has a separate timeline

The ordinary default is 90 minutes plus a random offset up to 30; DC computer policy normally checks every five minutes. These intervals are configurable, and a setting can still need a later foreground cycle. Changes must also reach the DC from which the client reads them. A successful local refresh while that DC still has the old version is consistent with the old setting remaining effective. See the refresh policy reference.

For permission-related user-policy failures, include the computer’s ability to read the user GPO. The tracing guide covers MS16-072, ActivityIDs, and the distinction between denied scope and a failing extension.

Separate the GPO list from each extension’s work

The engine derives a filtered GPO list, then selects the subset relevant to each CSE. gPCMachineExtensionNames and gPCUserExtensionNames contain client-side and administrative-tool GUID pairs; the tool GUID is not another client extension to install. A server can expose the intended GPO while the client lacks the required CSE or cannot execute it in that processing mode. See the extension architecture.

Inspect one GPC on an explicit DC, using its GUID-named CN:

$dc = 'DC1.contoso.com'
$gpc = 'CN={11111111-2222-3333-4444-555555555555},CN=Policies,CN=System,DC=contoso,DC=com'
Get-ADObject -Identity $gpc -Server $dc -Properties flags,
    gPCMachineExtensionNames,gPCUserExtensionNames,gPCFileSysPath |
    Select-Object flags,gPCMachineExtensionNames,gPCUserExtensionNames,gPCFileSysPath

# Run on the affected client to inspect installed extension registrations.
Get-ChildItem -LiteralPath 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\GPExtensions' |
    Select-Object PSChildName

Match the GUID with the CSE’s operational start/end events and installed component. Don’t copy a GUID key from another machine to fix a missing registration. The core protocol’s extension sequence runs the Registry extension first and handles each extension’s failure separately. The overall cycle can finish even when one category of settings failed.

A preference action is part of the setting

For a drive-map preference, the actions have distinct meanings:

Create, Update, and Replace can create a missing mapping; inspect the drive-letter selection options too. The drive-map protocol defines these details. For Files preferences, Update changes selected attributes of an existing file; it does not refresh that file’s contents from the source. Use the file-preference semantics when diagnosing an apparently successful copy that left old contents.

Item-level targeting runs for each preference after the GPO enters scope. Check Apply once, Remove this item when it is no longer applied, the security context, and whether an earlier failed item stopped the remaining items in that extension. Preferences can remain after the GPO leaves scope by default, and apply-once items intentionally resist later reapplication. The preference options guide explains those switches. Seeing the GPO in the Applied list won’t tell you what happened to each item.

For security settings, use baseline validation to compare intended configuration with effective state, then compliance evaluation to distinguish a recent applicable measurement from a stale, missing or unevaluated result.