DEV Community

Bryz︱🦾
Bryz︱🦾

Posted on

🛑 Group Policy Not Applying? Refresh, Verify, Then Check the OU

#itsupport #windows #activedirectory #beginners

You pushed a new Group Policy. The user swears nothing changed. 😩

Before you reimage the machine or blame Active Directory, slow down. Most "GPO not applying" tickets come down to one of three things: the PC hasn't refreshed yet, the GPO is being filtered out, or the user or computer is sitting in the wrong OU.

Here's the quick routine I use. 👇

🔄 Step 1: Force a refresh

Group Policy refreshes in the background every 90 minutes or so (with a random offset). If you just made the change, the machine may simply not have it yet.

Open Command Prompt or PowerShell on the affected PC and run:

gpupdate /force
Enter fullscreen mode Exit fullscreen mode

Some settings (like software installs or folder redirection) only apply at sign-in or startup. If it asks to log off or restart, say yes.

🔍 Step 2: See what actually applied

Now check what the machine really received:

gpresult /r
Enter fullscreen mode Exit fullscreen mode

Look at two sections:

  • Applied Group Policy Objects: your GPO should be listed here.
  • The following GPOs were not applied because they were filtered out: if your GPO is here, the reason is shown next to it (for example, security filtering or a WMI filter).

Want only the computer side or the user side?

gpresult /r /scope computer
gpresult /r /scope user
Enter fullscreen mode Exit fullscreen mode

For a full, readable report you can share with your team:

gpresult /h C:\Temp\gpreport.html
Enter fullscreen mode Exit fullscreen mode

Run it from an elevated prompt to include computer settings.

🗂️ Step 3: Check the OU

A GPO only applies to objects in the OU it's linked to (and child OUs, unless inheritance is blocked).

Remember the golden rule:

  • ⚙️ Computer Configuration settings follow the computer object.
  • 👤 User Configuration settings follow the user object.

So a user setting in a GPO linked to a computers-only OU won't reach the user. You can check where a computer lives with PowerShell (RSAT AD module needed):

Get-ADComputer $env:COMPUTERNAME | Select-Object DistinguishedName
Enter fullscreen mode Exit fullscreen mode

✅ The takeaway

  1. Refresh with gpupdate /force.
  2. Verify with gpresult /r.
  3. Confirm the user or computer is in the right OU.

Three checks, a couple of minutes, and you'll usually know exactly why the policy didn't land. No reimage required. 🙌

What's your first move when a GPO won't stick? Drop it in the comments 👇

Top comments (0)