This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(153.6, 28.999999999999996%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
I have a group policy , and need to deny that for a group of people. I created a universal security group and added to delegation- advanced - and allowed read and denied apply group policy. But it not working and the the group policy is still applied to that group of people. It works when I deny it for an individual user .Please help.
Please see my GPO settings:
The GPO is applied to entire users and computers, 'Only Authenticated users ' to security filtering. GPO is applied in user configuration .
Thanks
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(233.6, 96%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFF%3C/text%3E%3C/svg%3E)
Hi,
Based on your description , the GPO configuration seem no problem.
Only the group delegation were not working.
One situation can be considered that the user didn't recognize the new membership .
So i would suggest :
Log on the user and run the command : klist purge and then :gpupdate /force and check if it works.
If not , try to log off and log on again to refresh the group membership.
Best Regards,
Hi,
Welcome to share your current situation if there are any updates.
Please feel free to let us know if you need further assistance.
Best Regards,
Hi
IUnchecked the allow for 'read' and it started working now. Not sure if that will cause additional problems.
Hi,
If there are any issues , please feel free to post here!
A similar issue happened when I applied GPO to a group. I want to apply GPO only to one Universal security mail enabled group. Added allow 'group policy settings ' and allow 'read' .
Authenticated users is allow 'read'.
I see the group I added in security filtering.
In links , there is 'users and computers'.
The required settings are there in scope.
But the GPO is not applying to the group.
When the GPO is linked to 'Users and Computers' , does it include all the OUs in AD ?
Please help ...