Why is Group Policy Filtered out?

Question

I have a test computer I am trying a new GPO on.

The GPO is folder redirection, while it's set to - Security Filter: authenticated users - It is linked to the test OU

Running gpresult I get the following:

Computer Settings

The following GPOs were not applied because they were filtered out
-------------------------------------------------------------------
 Local Group Policy
     Filtering:  Not Applied (Empty)

 My Documents - Redirection
     Filtering:  Not Applied (Empty)

This is the GPO report

My Documents - Redirection 
Data collected on: 9/4/2011 15:04:18  

General
Details
Domain optitex 
Owner OPTITEX\Domain Admins 
Created 8/31/2011 16:45:20 
Modified 9/4/2011 14:44:56 
User Revisions 3 (AD), 3 (sysvol) 
Computer Revisions 0 (AD), 0 (sysvol) 
Unique ID {C8B51C9A-04B3-43CE-8BCA-C1FF4574} 
GPO Status Enabled 

Links
Location Enforced Link Status Path 
Desktops Yes Enabled optitex/OptiTex Computers/Default/Desktops 
IT Test Yes Enabled optitex/OptiTex Computers/IT Test 

This list only includes links in the domain of the GPO.
Security Filtering
The settings in this GPO can only apply to the following groups, users, and     computers:Name 
NT AUTHORITY\Authenticated Users 

WMI Filtering
WMI Filter Name None 
Description Not applicable 

Delegation
These groups and users have the specified permission for this GPOName Allowed Permissions Inherited 
NT AUTHORITY\Authenticated Users Read (from Security Filtering) No 
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS Read No 
NT AUTHORITY\SYSTEM Edit settings, delete, modify security No 
OPTITEX\Domain Admins Edit settings, delete, modify security No 
OPTITEX\Enterprise Admins Edit settings, delete, modify security No 

Computer Configuration (Enabled)
No settings defined.
User Configuration (Enabled)
Windows Settings
Folder Redirection
My Documents
Setting: Basic (Redirect everyone's folder to the same location)
Path: \\privatenas\%username%
Options
Grant user exclusive rights to My Documents Enabled 
Move the contents of My Documents to the new location Disabled 
Policy Removal Behavior Restore contents 

Is there a way I can find out Why was it filtered out?

Solution 1

It looks like you've defined the group policy objects settings in the 'User' tree, but are trying to apply it on an OU that contains computer objects. GPOs won't work this way.

See the part of the GPO report that says this:

Computer Configuration (Enabled)

No settings defined.

Only the 'User' portion of a GPO can be applied to Users, likewise only the 'Computer' portion of a GPO can be applied to Computers. If you create a GPO with some User settings in it, then attach it to an OU that contains computers, it won't do anything because none of it's settings are considered relevant.

There is one exception to this - Loopback processing. But it should only be applied in a few specific circumstances.

Solution 2

As Chris stated in his answer, GPO settings for users need to be linked to the OU where the user object resides. Folder Redirection is a user setting and therefore will have no affect if you link the GPO with your Folder Redirection settings to the OU where the computer object resides.

Comments

[Saariko]

Is it possible than to have folder redirection based on Users + Desktops? I mean - I don't want that laptops will have the GPO settings.

[Aashraya Singal]

Ah, that IS one of the exceptions where loopback processing is useful. You'll need to configure it on the OU that contains the desktops, and apply it in Merge Mode so that all your other User policies continue to take effect: support.microsoft.com/kb/231287

[Nixphoe]

Although, technically this is correct, it is incorrect in the context of this question as the user has his OUs setup in a way that makes this answer incorrect.