Group Policy not applying to laptop connected to VPN

Question

I haven't been able to get Start Layout GPO to work for laptops that connect over VPN. I've set up my VPN to connect before I logon with my user account but for whatever reason the GPO is still not changing my settings.

I know that I set up my Start Layout file correctly because when I run the Import-StartLayout command with the .xml I've made it makes the changes to my Start Menu and to my Taskbar. I've also been able to make a Local Group Policy and I can see my my Start Menu and Taskbar changing when I log out and log back into my account. I'm fairly certain my GPO is set up correctly because computers that are connected locally to our domain controller and aren't having to connect by VPN are able to update and apply the Start Menu .xml file.

For reference I used the template here as a base for my .xml https://learn.microsoft.com/en-us/windows/configuration/configure-windows-10-taskbar
I also followed this when creating my GPO https://learn.microsoft.com/en-us/windows/configuration/customize-windows-10-start-screens-by-using-group-policy

Bit of a weird one, hoping someone has experience with this.

Answer 1

Hello @GRattu

In this case, since the policy is applying correctly to on premise computers, I would recommend looking in the next:

• Policy being restricted by overlapping policy that "locks" the Start Layout: extracting an RSOP via GPUPDATE /H OUTPUT.HTML may help to identify all the policies applying into a VPN connected machine
  Reference: https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult
• That aside, the most likely issue with remote or VPN computers is the network readiness. For this, 2 options:
  A) GPO engine detects a slow link and doesn't distribute the policies:
  Set the policy for Slow Link Detection as Disabled:
  Policy path: Policies\Administrative Templates\System\Group Policy\Slow Link Detection 0 to disable
  Reference: https://learn.microsoft.com/en-us/troubleshoot/windows-server/user-profiles-and-logon/manage-profile-service-slow-link-detection

B) Network not ready during the synchronous load of policies:
Set the policy to “Always Wait for the Network at Computer Startup and Logon” as Enabled for the VPN computer group
Policy path: "Computer Configuration \ Administrative Templates \ System \ Logon \ Always wait for the network at computer startup and logon"
Reference: https://learn.microsoft.com/en-us/previous-versions/windows/desktop/policy/logon-optimization

Hope this helps with your query,

--
--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

I gave both of those a try and I'm unfortunately still seeing the same behaviour. The Slow Link Detection was not configured by default, I changed that to Disabled anyway. I also set the Always Wait for the Network at Computer Startup and Logon to Enabled.