Share via

Group Policy security filtering adjustments causing entire computer collections to lose core administrative configurations

Oscar Green 0 Reputation points
2026-06-10T16:05:59.7733333+00:00

Hi, I attempted to remove a specific computer object from an active GPO baseline by adjusting the Security Filtering list, replacing "Authenticated Users" with a targeted AD security group. The unexpected consequence is that now the entire OU has lost access to the GPO configurations because Domain Computers requires Read permissions.

Windows for business | Windows 365 Business
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Marcin Policht 92,045 Reputation points MVP Volunteer Moderator
    2026-06-10T16:13:48.6133333+00:00

    That's expected. For a GPO to be processed, the computer objects in scope must have at minimum read permissions to that GPO.

    Details at https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/cannot-apply-user-gpo-when-computer-objects-dont-have-read-permissions

    If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

    hth

    Marcin

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.