Troubleshoot Group Policy Processing on Windows

Admin

October 4, 2026

7 min read

When a Windows setting is missing, trace policy processing from the affected user or computer to the domain controller and then to the individual Group Policy Object (GPO). This workflow uses result reports and event logs before requesting another policy refresh.

Run the checks on the affected computer with an account that can read the relevant policy results. A forced refresh can trigger scripts, software installation, or a restart request, so gather evidence first and coordinate the refresh with the device owner.

Check Domain Membership and the Current Network

Starting State

Verify domain membership, domain controller discovery, and the secure channel. A client pointed at a public DNS resolver or an unreachable domain controller may not process domain policy.

$computer = Get-CimInstance Win32_ComputerSystem
$computer | Select-Object Name, Domain, PartOfDomain
nltest /dsgetdc:$($computer.Domain)
Test-ComputerSecureChannel -Verbose
ipconfig /all

Capture gpresult Reports for Both Scopes

Policy Results

Run the computer report from an elevated shell and the user report in the affected user’s session. Review applied and denied GPO lists, including the reason each denied GPO was filtered.

New-Item -ItemType Directory -Path C:\Temp\GpoReview -Force | Out-Null
gpresult /scope computer /h C:\Temp\GpoReview\computer.html /f
gpresult /scope user /h C:\Temp\GpoReview\user.html /f
gpresult /r /scope computer

Windows Group Policy Results showing applied and filtered Group Policy Objects for a workstation

Figure 1: Compare applied GPOs and filtering reasons in a Group Policy results report.

Trace a Setting to Its Winning Policy

Policy Source

Use Resultant Set of Policy to inspect the winning setting. Then review the Group Policy operational log around the last processing cycle for extension, connectivity, or permission errors.

rsop.msc
Get-WinEvent -FilterHashtable @{
  LogName = 'Microsoft-Windows-GroupPolicy/Operational'
  StartTime = (Get-Date).AddHours(-4)
} -ErrorAction SilentlyContinue |
  Select-Object -First 30 TimeCreated, Id, LevelDisplayName, Message |
  Format-List

Apply the Approved Policy Change

Controlled Refresh

Check scope, security filtering, WMI filtering, replication, SYSVOL access, and setting precedence. After coordinating the fix and refresh, rerun the reports and verify the target setting.

gpupdate /target:computer /force
gpresult /scope computer /r