Group policies are not applied in Hyper-V environment.

Igro

Hello friends! I'm digging into GPOs here and already have some problems. I've got the active directory in entirely virtual space here - all machines are running by Hyper-V. What I've got here: Windows Sever 2012 R2, Windows 8 Pro and Windows 7 Pro (Hyper-V itself is running on Windows 10 Educational (all the rest are educational licences too)). The AD works fine. I decided to test the GPO to remove the clock from notification area first.

So it didn't work. I've made a ping from server to client and vice versa and one of them didn't work. I switched the firewalls off everywhere and then pings finally worked. But GPOs didn't work anyway. I used GPUPDATE command on the host in question (Win 8 here) and it didn't work, even when i run PowerShell in administrator mode. I'm not a PRO, so i can't find where is the problem. Sorry if this has been questioned may times.

AndersonSmith

Run a gpresult command on the client in question and check to see if it's actually applying the policy. Also check to see if there are any conflicting GPOs with higher precedence or that are enforced that may be causing problems. If it's a user policy check to make sure the user is in the correct OU the GPO is applied to and if it's a computer policy check to make sure the computer is in the correct OU the GPO is applied to. Start with the gpresult command first and see what that tells you. I hope that helps. Group Policy can be a nightmare even for seasoned admins

Dojiscalper

Also remember the order the policies get applied; Local, Site, Domain, Organizational Unit.
I found some policies not working when applied as user policies, but they did work when I applied them to the computer. I think I read somewhere that
the computer policy overrides user policy if they happen to conflict.

Igro

Thank you guys! Sorry for the late answer. I will check that out. I'm really digging into Servers and it's a big puzzle.

AndersonSmith

User policies actually override Computer policies when there's a conflict UNLESS Loopback Processing is enabled. Check out this Technet article for more info https://technet.microsoft.com/en-us/library/cc785665(v=ws.10).aspx . Good luck in your studies, Group Policy can be difficult.

Igro

Hi AndersonSmith! I have checked the Result /R and this is what i got (the GPO Name is NewDesktop and this must have changed wallpapers for all the users. The wallpaper is a jpg file, though its resolution is not in pair with the real resolution of the desktop. Security filtering - Authenticated users. Authenticated users have permissions Read and Apply):

This is where the GPO was linked:





Or maybe it's because of this?:


To be honest, i have no clue why authenticated users are listed twice. However, in the Delegation window is always Read:

AndersonSmith

Where is the wallpaper file stored that you're trying to use? If I remember right it has to be on a file share with permissions for the users who will be applying the wallpaper. For example, you could use \\file1\share\wallpaper.jpg. The share folder should be given the appropriate share and NTFS permissions. Try setting both to full control and see if that helps. You can also use a local path on the domain controller such as C:\wallpaper\wallpaper.jpg and adding the appropriate permissions on it but using UNC path works better.