Group memberships don't update until the Kerberos ticket is renewed, which would happen on reboot. If RSOP says that security is why the policy was not applied, then double-check that your group memberships are correct. Similarly, gpresult /r /scope computer will give you the resulting memberships/policies without wasting time/space on the user portion. Since this is a machine policy, a useful debug step is to use gpupdate /target:computer to verify that you're updating specifically the portion you're interested in. For most situations, you don't need /force. If you don't have the proper security to do it, you'll get Access Denied.įor the record, /force only makes gpupdate reapply all applicable policies. You can verify this by explicitly using gpupdate /target:computer. In most configurations, doing gpupdate in a non-elevated security context will only update user policy. Seen a bunch of people tapdancing around this, but it bears pointing out. Logout and attempt to login on laptop under OU with an account in restricted groups and I can still login.I do gpresult /z and I see that the last gpupdate was seconds ago.Īm I missing something? Thanks for the help. Right-click, Edit, Computer Configuration > Policies > Windows Settings > Security > User Rights Assignment > Deny log on locally, right-click > Properties, add all the student groups, under Define these policy settings. GPM > Collapsed down to the OU I want (Laptops) > Create GPO in this domain, and Link it here. I have an OU with a bunch of laptops in it and I want to keep users from group 'Students' from logging in locally on said laptops under. I'm kind of a noob to Active Directory but I'm pretty sure I've done this correctly from what I've found online. (Domestic only, I'm not making that foreign brews money yet) Thank you all for your help :) If I ever see you guys IRL I owe you all a beer.

Deny logon locally powershell