Software installation policy not working on domain controller

Question

We have a domain controller (server 2019) at an offsite that allow for users to connect to (over a VPN connection) it if our main office goes down.

There is a VPN connection between that offsite and the main site.

For a test we disconnected the VPN between the two sites and users are VPN'ing directly into the offsite. They then connect via Remote desktop.

The first time the users connects to this environment all their group policy software installs as expected. The next time they signed in all their software falls out of scope, I believe, and uninstalls. I am not sure what changed. ( I am thinking the VPN disconnect between the two sites has something to do with this). But I cannot make sense of it.

GPResult shows the software policies are still applied at the user level. But the software is not present. We can browse out to the local DFS and manually install the software with no issues.
There are no errors in the event logs showing that errors were present while trying to install the software.

Running rsop shows the software installation polices are not applied.

Any ideas?

Answer 1

Uninstalling the Remote Desktop Services role from this server allows the user based group policy installation to work just fine.

Answer 2

As you said, "GPResult shows the software policies are still applied at the user level." We can run gpupdate /force and collect gpresult again later to confirm whether the user gets the software installation GPO.

If we confirm that the GPO has been obtained, software installation requires two restarts to complete. That is, even if the GPO settings are currently obtained, we still need to reboot to install this application. This is a by-design behavior.

Please refer to the following connection

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj573586(v=ws.11)#asynchronous-and-synchronous-processing

“For CSEs such as Folder Redirection, Software Installation, and Drive Maps preference extension, the outcome of Group Policy processing might adversely affect the user’s experience, for example, a program being uninstalled while the user is working with it. To keep this from happening, the CSE is designed to require synchronous processing to apply the new settings. During asynchronous processing, the CSE signals the system to indicate that a synchronous application of Group Policy is required. A synchronous application of Group Policy occurs at the next startup (if it is signaled during the computer Group Policy refresh) or at the user’s next sign-in (if it is signaled during the user Group Policy refresh).”

Hope this information can help you
Best wishes
Vicky