GPO updated but not applied

Jie wei 116 Reputation points
2021-10-18T07:31:04.763+00:00

I have 2 different GPOs, both which contain the same settings. These 2 GPOs are applied only one at a time, with the other unlinked if one of the GPOs are linked.
One GPO was configured using the GPMC.msc, the other is configured using Powershell "Set-GPRegistryValue" cmdlet.
Using GPMC.msc, i can confirm that the settings in the GPO have been updated from the Powershell cmdlets.
Even on the Client RSOP.msc, I am able to view the settings for both of these policies.
However, when applying to an Organizational Unit (OU), the GPO that was configured by Powershell does not apply (despite rsop.msc saying so) , but the GPO configured by the GPMC.msc GUI applies.

The particular settings that were tested is from LAPS, with the following commands:
Reset-AdmPwdPassword
Get-AdmPwdPassword

Reset-AdmPwdPassword and Get-AdmPwdPassword works when GPO that is created using GUI is applied, but not the GPO created using Powershell. [On the GPO created by Powershell, Reset-AdmPwdPassword does not change password even after client has done a gpupdate. Get-AdmPwdPassword will give blank when it is the first GPO applied]

Do I need to do something else after using the Set-GPRegistryValue?

Active Directory
Active Directory
A set of directory-based technologies included in Windows Server.
5,822 questions
Windows Server PowerShell
Windows Server PowerShell
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.PowerShell: A family of Microsoft task automation and configuration management frameworks consisting of a command-line shell and associated scripting language.
5,355 questions
0 comments
Accepted answer
  1. Gary Reynolds 9,391 Reputation points
    2021-10-19T01:59:36.283+00:00

    Hi,

    The client extension is added automatically by the GPMC when you set an option that requires that extension, I don't believe there is a method to set this manually in the GPMC.

    If you want to create\change the GPO programmatically, you could add the client side extensions GUID to gPCMachineExtensionNames attribute of the GPO object.

    I hope that helps.

    Gary.

    0 comments

5 additional answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Gary Reynolds 9,391 Reputation points
    2021-10-18T11:07:16.793+00:00

    Hi @Jie wei

    Have a look at this post to help troubleshoot why the policy is not being applied and review what settings are being written to the policy.

    Gary.

    0 comments
  2. Jie wei 116 Reputation points
    2021-10-18T14:44:42.067+00:00

    Hi @GaryReynolds-8098 ,
    I've looked at the post that you mentioned and have the following results. It is mentioned that the GPO section is empty, and yet, in the RSOP.msc, the values are set. Hope you are able to help. The result is for the GPO created by Powershell.
    141317-img.png

    0 comments
  3. Gary Reynolds 9,391 Reputation points
    2021-10-18T20:22:27.98+00:00

    Hi @Jie wei

    The policy hasn't been applied because the version is 0, which indicates that policy is empty. However, this is the local policy, this is not the policy you created in gpmc so shouldn't be linked to your problem.

    Check for the name of the policy you created, I'm assuming its gp_raw, which is showing a green indicator meaning it was applied to the machine. Use the GPO Explorer option to compare the two gpos you created, and see if there any differences, the Settings tab lets you see the raw settings.

    If the GPO is being applied but it is not working as expected using the powershell command, there gpmc might be adding additional settings that enable the feature.

    Gary.

    0 comments
  4. Jie wei 116 Reputation points
    2021-10-19T01:38:09.59+00:00

    Hey @GaryReynolds-8098 ,

    You're right, it was an oversight on my part, and I can verify that the policy is being updated on the client.141536-img2.png.

    By using the GPO Explorer tool, it seems that the difference between the 2 GPOs are that the working version has the LAPs Client extension, while the non-working version does not.
    As I've compared all the settings available in the GPMC, and was unable to find this particular setting, I hope that you're able to help. 141448-img2.png

    0 comments