GPO deny not working for group

Question

We want to deny a group policy for a group of computers. If I add the computers individually to the delegation tab with deny read and deny apply, the group policy does not apply. If I add an AD group with these computers as members, the policy still applies.

Is there a way to deny a group of computers from applying a GPO or do I have to add each computer manually? Or maybe a better question is why does the deny work individually and not work at all for a group?

Answer 1

Hi @JustAnotherUser

Did you try clear kerberos ticket in the cache by restarting computer ?

When you add or remove user or computer from a AD group , you should clear kerberos ticket in the cache to be taken in account.

Please don't forget to mark helpful answer as accepted