on-premises Active Directory

Use the built-in Group Policy troubleshooting tools on an affected workstation to determine why the GPOs are not applying and then correct the specific cause.

1. Collect Resultant Set of Policy (RSoP)
   1. Run the following on an affected workstation:

            gpresult /h gp.html
      

   2. Open gp.html and look for the missing GPOs under both Computer Configuration and User Configuration.
   3. Check the “Denied GPOs” or error section at the bottom; it will state why each GPO is not applied (for example, security filtering, WMI filter, permissions, or other denial reasons).
2. Check Group Policy event logs
   1. Open Event Viewer on the affected workstation.
   2. Review:
      • Application and System logs for Group Policy–related errors.
      • Applications and Services Logs → Microsoft-Windows-GroupPolicy → Operational.
   3. In the Operational log:
      • Event ID 4116 marks Group Policy processing start; 8005 marks completion.
      • Compare the list of applied and denied GPOs.
      • Look for events that show the missing GPOs being denied and note the reason (for example, access denied, WMI filter evaluation, or DC connectivity issues).
3. Verify GPO permissions and security filtering
   1. In Group Policy Management Console (GPMC), open the affected GPO.
   2. On the Delegation tab, ensure:
      • The target computers (or a group containing them) have Read permission.
      • The target users/computers also have Apply group policy permission if required.
   3. If computer objects do not have Read permission, create a group for those computers, add them, and grant that group Read (and Apply if needed) on the GPO via the Delegation tab.
   4. Run gpupdate /force on the client and re-check gpresult.
4. Compare working vs non-working clients
   1. On a working machine where the GPO applies, collect:

            gpresult /h gp_working.html
      

   2. Compare gp_working.html with gp.html from a failing machine to see:
      • Which GPOs are present on the working machine but missing on the failing one.
      • Any differences in denied GPOs or error messages.
   3. If needed, export and compare Group Policy Operational logs from both machines to identify differences in DC selection, GPO counts, or processing paths.
5. If no obvious error appears
   1. Follow the checklist:
      • Confirm the GPO is linked to the correct OU/site/domain where the computer/user resides.
      • Confirm the link is Enabled and the GPO is not set to Disabled.
      • Confirm no higher-level GPO or OU has Block Inheritance or Enforced settings that override the target GPO.
   2. If still unresolved, enable GPSvc verbose logging as described in the guidance and review the resulting logs for detailed processing information. Use this only temporarily because of performance and disk-space impact.

These steps will identify whether the issue is due to permissions (no Read/Apply), filtering (WMI or security), DC connectivity, or link configuration, and allow correction so the on-premises GPOs appear in gpresult and apply to the targeted workstations.

References:

• Scenario guide: Wallpaper GPO doesn't apply on some client computers
• Can't apply user Group Policy settings if computer objects don't have GPO Read permissions
• Applying Group Policy troubleshooting guidance