Since security update MS16-072, Windows reads user GPOs with the
computer's account. Group filtering is still possible (GG-Compta: Apply), but the
computers must still be able to read the GPO. By removing Authenticated Users (which contains the
computer accounts), Reda removed that read access: gpresult shows “Denied (Security)”.
The other leads are ruled out by the outputs: the link is active (Get-GPInheritance), Sanaa is indeed
in GG-Compta, and repadmin shows no replication failure.
Incident resolved
Analysis and fix
Fix: give read-only access back to Authenticated Users (or to Domain Computers), without giving them “Apply”:
Set-GPPermission -Name 'Compta - Lecteur Z' -TargetName 'Authenticated Users' -TargetType Group -PermissionLevel GpoRead
Invoke-GPUpdate -Computer PC-COMPTA-03 -Force
Verification: gpresult /s PC-COMPTA-03 /user ALAMAL\s.bennis /r must list the GPO under “Applied
Group Policy Objects”, then Sanaa gets Z: back.
To keep it from happening again:
- simple rule: filter with “Apply” for the intended group, but always leave Read to Authenticated Users or Domain Computers;
- test a modified GPO on a pilot workstation (
gpresult) before leaving it in place; - back up GPOs before changing them (
Backup-GPO -All -Path …).