Start here
What actually applied to this machine
gpresult /r /scope:computerA readable report to send on
gpresult /h rsop.html /fRe-apply now
gpupdate /forceWhich GPO won, and why
Precedence in the HTML report
Policy applies but slowly
Events
8000 and 8001Nothing applies at all
Events
1058, 1030, 1129
Two different failures. Either the client cannot read the policy, which is a network, DNS or SYSVOL problem, or it read it and decided the policy does not apply, which is filtering and precedence. The event log tells you which of the two you have.
gpupdate and gpresult
| Task | Command |
|---|---|
| Apply changed settings | gpupdate |
| Re-apply everything, changed or not | gpupdate /force |
| Computer settings only | gpupdate /target:computer /force |
| Settings that need a reboot or a logoff | gpupdate /force /boot or /logoff |
| Wait longer than the default 600 seconds | gpupdate /force /wait:1800 |
| Make the next boot or logon apply policy synchronously | gpupdate /target:computer /sync – the fix for folder redirection, drive maps and software installation that never land. /force and /wait are ignored with /sync |
| Summary of what applied | gpresult /r |
| Computer scope, needs elevation | gpresult /r /scope:computer |
| Full HTML report | gpresult /h C:\temp\rsop.html /f |
| Another machine and user | gpresult /s PC01 /user DOM\jdoe /h C:\temp\pc01.html /f |
| Verbose text, every setting | gpresult /z |
| PowerShell equivalent | Get-GPResultantSetOfPolicy -ReportType Html -Path C:\temp\rsop.html |
| Remote update across an OU | Invoke-GPUpdate -Computer PC01 -Force |
gpresult without elevation hides half the answer. A normal console returns user policy only and silently omits the computer scope, which is usually the half you are looking for.
Processing order
| Step | Applied |
|---|---|
| 1 | Local policy on the machine |
| 2 | Site |
| 3 | Domain |
| 4 | Organisational units, outermost first |
| 5 | The OU closest to the object, which normally wins |
| Modifier | Effect |
|---|---|
| Enforced | Reverses the order: this GPO beats anything closer to the object |
| Block Inheritance | Stops inherited GPOs, except Enforced ones |
| Link order on one container | Lowest number wins, it is processed last |
| Loopback, Merge | User settings from the computer’s GPOs are added, and win |
| Loopback, Replace | Only the computer’s user settings apply, the user’s own are ignored |
| Disabled link | Not processed at all, and easy to miss in GPMC |
Loopback explains most “it works at my desk” tickets. On terminal servers and kiosks it is usually already on, so the user’s own GPOs never get a chance. Check the computer’s GPOs, not the user’s.
Filtering
| Mechanism | What it needs |
|---|---|
| Security filtering | The target needs both Read and Apply group policy |
| Removing Authenticated Users | Add the computer account back with Read, or the GPO silently stops applying |
| Delegation tab | Where the real permissions live, the filtering box is a summary |
| WMI filter | Evaluated on the client, per computer, and costs time on every refresh |
| Item-level targeting | Preferences only, evaluated per item rather than per GPO |
| Disabled half of a GPO | Computer or user section switched off in the GPO’s own settings |
The MS16-072 trap. Since that update, user GPOs are read in the computer’s context. Any GPO where Authenticated Users was removed from Read stops applying, and the classic symptom is mapped drives and printers disappearing for everyone at once. Grant the computer accounts, or Authenticated Users, Read without Apply.
Events worth knowing
| ID | Meaning |
|---|---|
1058 | Cannot read gpt.ini. SYSVOL access, DFS or permissions. |
1030 | Failed to query the list of GPOs, usually the same root cause as 1058 |
1129 | No network at boot, policy processing was skipped |
1085 | One client-side extension failed, the rest still applied |
1500 / 1501 | Computer / user policy processed, nothing changed since the last run |
1502 / 1503 | Computer / user policy processed, new or changed settings applied |
1096 / 7016 | Registry.pol could not be read or applied, often corrupt local state |
7017 | A system call made by the Group Policy service failed |
4016 / 5016 / 6016 | Extension started, finished, or failed, with a duration |
8000 / 8001 | Computer and user processing complete, with total time in ms |
5312 | The list of GPOs that were actually applied |
5313 | The list that was filtered out, and why |
5312 and 5313 are the fastest answer in the whole stack. One says what applied, the other says what did not and which filter stopped it. Both live in
Microsoft-Windows-GroupPolicy/Operational.
Where it lives
| Item | Path |
|---|---|
| GPO files on the domain | \\domain\SYSVOL\domain\Policies\{GUID} |
| Version stamp compared against AD | gpt.ini inside that folder |
| The settings themselves | Machine\Registry.pol and User\Registry.pol |
| Local policy on the client | C:\Windows\System32\GroupPolicy |
| Per-user local policy | C:\Windows\System32\GroupPolicyUsers |
| Operational log | Microsoft-Windows-GroupPolicy/Operational |
| Verbose service log, after enabling it | %windir%\debug\usermode\gpsvc.log |
| Management console | gpmc.msc, local editor gpedit.msc |
| Task | Command |
|---|---|
| All GPOs in the domain | Get-GPO -All | Select DisplayName,ModificationTime |
| Export one GPO as a report | Get-GPOReport -Name "Drive Maps" -ReportType Html -Path C:\temp\gpo.html |
| What is linked to an OU, and is inheritance blocked | Get-GPInheritance -Target "OU=Workstations,DC=corp,DC=local" |
| Back up every GPO | Backup-GPO -All -Path D:\gpo-backup |
| Find a setting across all GPOs | Get-GPOReport -All -ReportType Xml | Select-String "ScreenSaveTimeOut" |
Slow logon and refresh
| Question | Where to look |
|---|---|
| How long did policy take | Events 8000 and 8001, the duration is in the message |
| Which extension was slow | Events 4016 and 5016 pairs, one per extension |
| Slow boot or slow logon overall | Microsoft-Windows-Diagnostics-Performance/Operational, ID 100 for the boot summary (MainPathBootTime plus BootPostBootTime), 101 to 110 for the application, driver or service that caused the delay |
| Drive maps and printers are the usual suspects | Preferences run per item, over the network, at every refresh |
| Refresh interval | 90 minutes plus a random offset up to 30, and at every boot or logon |
| Settings that never refresh in the background | Folder redirection and software installation, they need a logon or boot |
Recipes
| Task | How |
|---|---|
| A setting is not applying, start to finish | gpresult /h on the client, read Applied and Denied, then check filtering and precedence in GPMC |
| Prove it is not the client | Run gpresult /r /scope:computer on a second machine in the same OU |
| Confirm SYSVOL is readable | Open \\domain\SYSVOL\domain\Policies from the client, as the client’s own account |
| Check the version stamp matches | Compare gpt.ini with the GPO’s version in GPMC. A gap means replication. |
| Chase a replication gap | repadmin /replsummary and dcdiag /test:sysvolcheck |
| Turn on verbose logging | Set GPSvcDebugLevel to 0x30002 under HKLM Diagnostics, create %windir%\debug\usermode, then reproduce |
| Reset a client that refuses everything | Rename C:\Windows\System32\GroupPolicy, reboot, then gpupdate /force |
| Roll a GPO back | Restore-GPO -Name "Drive Maps" -Path D:\gpo-backup |
Renaming the GroupPolicy folder is not free. It discards local policy and every cached setting, and on a machine that also uses local security policy you will lose that configuration. Back the folder up rather than deleting it, and never do it on a domain controller.
FAQ
gpupdate /force says everything succeeded, but the setting is still missing.
Success means the client processed the GPOs that apply to it. If yours is not among them, nothing failed. Read event
5313 or the Denied section of gpresult /h, which names the filter that excluded it.
The GPO applies to some machines and not others in the same OU.
Look for a WMI filter, a disabled link, or a second GPO with higher precedence setting the same value back. On a mixed estate the WMI filter is the common answer, because it silently evaluates false on an OS version you did not test.
Do I still need gpupdate /force, or is plain gpupdate enough?
Plain
gpupdate applies only what changed, which is what you want in production. /force re-applies everything and is for troubleshooting, because it also rewrites settings a local admin changed by hand.
Why did drive maps stop working for everyone after a patch?
Almost certainly MS16-072. User GPOs are now read in the computer’s security context, so any GPO where Authenticated Users lost Read stops applying. Restore Read for Authenticated Users or add the computer accounts.
Is rsop.msc still useful?
It shows the resultant set but not the reasons, and it has been unreliable for years.
gpresult /h produces the same data plus precedence and denial reasons, in a file you can attach to a ticket.