Troubleshooting Change and Configuration Management

Inheritance Issues with Group Policy Objects Cause Unexpected Results

A user managed by Group Policy logs on and the Group Policy applied is different from what you expect.

Possible Causes:

The order in which Group Policy objects are applied is not what you expect. Policy applied later usually takes precedence.
There are Group Policy object No Override issues.
There are Block Inheritance issues.
The entire Group Policy object is disabled.
The user or computer parts of the Group Policy object are disabled.

Diagnostic Tests:

Write down a list of the Group Policy settings that you expect to be applied to your client user and computer. Using Gpresult.exe, generate the list of the Group Policy settings that actually applied to the client user and computer. Compare the two lists to find out which Group Policy settings are not applied.

Starting at the top of the directory tree, search down to locate the client user object. As you search down the tree, make a note of all organizational units and any associated Group Policy objects applied to each of these organizational units. Repeat this procedure for the client computer object.

Group Policy objects are applied in the following order: local, site, domain, organizational unit. If there is more then one Group Policy object that is associated to a specific site, domain, or organizational unit, these are applied in the specific order that you set.

To check the order in which multiple Group Policy objects are applied, right-click the site, domain, or organizational unit in question, and then select Properties. Then click the Group Policy tab.

Look for Group Policy objects that have special settings applied to them. Right-click the site, domain, or organizational unit that contains the Group Policy objects that you are investigating. Then click the Group Policy tab.

For each Group Policy object, check whether the No Override or Block Inheritance options are enabled. If these options are enabled on any Group Policy object, you should start from the top of the tree and work down to locate any No Override issues. Then start from the bottom of the tree and work upward to locate any Block Inheritance configuration issues.

Note

You should use the No Override and Block Inheritance features sparingly because they make troubleshooting Group Policy more difficult.

To confirm that the Group Policy object that you want to apply is not disabled, look at the Group Policy tab, and click Options.

To confirm that the Computer Configuration or User Configuration portion of the Group Policy object is not disabled, click the Properties button on the Group Policy tab, and check the General tab.