GPP-configured environment variable not resolving for a subset of users

Question

Since our GPP-configured environment variable is no longer resolving correctly, and I lost proper application functionality for a subset of users, I was told I needed to re-check our Group Policy setup. I have been looking into this.. and have been on the phone with a number of Chats and a few Quick Assist sessions but still have no resolving. The last Chat person insisted I needed to change Item Level Targeting, and use that.. but I have ILT set up for work, and only mostly use user-context evaluation on my PC.

EVERYTIME I need to try and get "in-app" help for the issue, I end up with instructions that don't match what's on my PC screen and I did have a tech person on Quick Assist but we got disconnected and I never got another person.

This has been going on for months.. and everytime I Chat I'm asked the same questions, and then they send me a link to in -app support that can't be followed.

The last chat person told me that user-context vs. computer-context evaluation "CAN'T WORK" in this scenario.. Strange.. I had it working before and my husband has it working now.

TOTAL FRUSTRATION -- At one point I was told I need a Group Policy Support expert, but the chat's don't connect me. In prior years when I lost my variable resolving all I did was reconnect the "Group Policy Management Console". Now that does nothing. My average call is hours long.. and one tech person left me with 22 Folders pinned in Windows Explorer. This has gone from bad to horrible and all I get when I give the chat person my Case # is "Let me read it and get the updates". In some cases they just disconnect. What's the ILT/user-context vs. computer-context evaluation issue to check????

Answer 1

Welcome to Microsoft Q&A!

Thank you for providing the details.

The statement that "user-context evaluation can't work in this scenario" is generally incorrect. Group Policy Preferences (GPP) can process settings in either the user or computer context, depending on how the preference item is configured.

This scenario can be supported through the use of Item-Level Targeting (ILT) and the "Run in logged-on user's security context" option for preference items. When configured appropriately, these features allow preference processing and targeting to be evaluated based on the logged-on user's context, even when the policy is applied through computer-side processing.

For a GPP Environment Variable that suddenly stops resolving for only a subset of users, I would focus on the following areas:

1. Verify where the Environment Variable preference is configured

• User variables should typically be configured under:

User Configuration → Preferences → Windows Settings → Environment

• Computer variables should typically be configured under:

Computer Configuration → Preferences → Windows Settings → Environment

2. Review Item-Level Targeting (ILT)

• Open the Environment Variable preference item and review the Common tab.
• Check all configured ILT conditions, including:
  • Security Group membership
  • OU membership
  • Computer Name
  • Environment Variables
  • WMI Filters
  • Other targeting filters
• Changes to group membership, OU placement, or targeting conditions can result in the preference applying to some users but not others. Internal Group Policy learning content specifically identifies ILT as a key component of GPP processing and troubleshooting.

3. Verify the processing context

If the environment variable depends on user-specific data (group membership, user profile information, user environment variables, etc.), ensure it is evaluated in the appropriate user context.

• User-side processing runs under the logged-on user.
• Computer-side processing runs under a system or service account.
• Group Policy processing impersonates the user account when evaluating user-side policies.

In addition, GPUpdate creates separate processing tasks:

• Computer refresh runs as a system/network service context.
• User refresh runs as the logged-on user and executes gpupdate.exe /target:user.

Because of this design, user-context processing is a supported and expected behavior.

4. Generate GPResult or RSoP data

Run:

gpresult /h gpresult.html

Then review the report and verify:

• The GPO containing the Environment Variable preference is being applied.
• The preference item is not being filtered out by security filtering, ILT, WMI filtering, or scope-related issues.

It is a recommendation that GPResult and RSoP as primary troubleshooting tools when investigating Group Policy processing issues.

5. Review Group Policy operational logs and GPP diagnostics

Check:

• Event Viewer → Applications and Services Logs → Microsoft → Windows → GroupPolicy → Operational
• Application log for Group Policy Preferences events

Recent Group Policy improvements provide more detailed GPP diagnostics, including additional event logging that can identify exactly which object or network path caused processing failures.

6. Check for processing-related conditions

Several Group Policy processing conditions can affect whether preferences are applied, including:

• Slow-link detection
• Background vs. foreground processing
• Loopback processing
• User vs. computer refresh cycles
• WMI filtering

Please notes that some preference and Client-Side Extension behaviors can vary depending on processing mode and network conditions.

Since the configuration previously worked and still works for another user, the evidence points more toward a targeting, scope, filtering, processing, or permissions issue rather than a limitation that prevents user-context evaluation from working.

The next troubleshooting step would be to compare the GPResult/RSoP output from a working user and an affected user. Differences in applied GPOs, ILT evaluation, group membership, WMI filtering, or security filtering often reveal the root cause of these kinds of GPP issues.

Reference: Working with Group Policy Preference Items Using the GPMC | Microsoft Learn

Group Policy preferences in Windows | Microsoft Learn

I hope this information helps. If you find the response useful, please click Accept Answer.

Thank you for using Microsoft Q&A.