GPO Unlink Issue: GPP Registry keys persistent on client endpoints after unlinking

Question

Hey team, facing a minor annoyance with Group Policy Preferences. We recently unlinked a GPO that drops a couple of custom Registry keys on client machines, but the registry values are still persisting on the endpoints even after a force gpupdate and reboot.

Looks like the preference items are tattooing the registry. Do we explicitly need to tick "Remove this item when it is no longer applied" under the Common tab, or should we be handling cleanup via Item-Level Targeting (ILT) with a delete action? Want to know the standard best practice before pushing the fix across all OU branches.

Answer 1

To clean up tattooed Group Policy Preferences (GPP), create a temporary cleanup GPO and use the Delete action rather than attempting to enable “Remove this item when it is no longer applied” on the original GPO. Since the original GPO has already been unlinked, enabling this option retroactively will not remove the settings from affected systems.

The reason the settings persist is due to the tattooing behavior of Group Policy Preferences. Unlike traditional Group Policy settings, GPP writes values directly to locations such as the registry and does not automatically remove those changes when the GPO is unlinked or no longer applies. The “Remove this item when it is no longer applied” option only works when the preference item was originally configured with that setting and the GPO remains in scope long enough for the client to process the removal. If the GPO is removed first, the tracking mechanism is no longer available.

The cleanup process is to create a dedicated temporary GPO and target it to the affected computers or users. Within this cleanup GPO, configure a Registry preference under Computer Configuration or User Configuration > Preferences > Windows Settings > Registry and set the action to Delete for the specific registry key or value that needs to be removed.

---

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin