GPP-configured environment variable not resolving for a subset of users

Welcome to Microsoft Q&A!

Thank you for providing the details.

The statement that "user-context evaluation can't work in this scenario" is generally incorrect. Group Policy Preferences (GPP) can process settings in either the user or computer context, depending on how the preference item is configured.

This scenario can be supported through the use of Item-Level Targeting (ILT) and the "Run in logged-on user's security context" option for preference items. When configured appropriately, these features allow preference processing and targeting to be evaluated based on the logged-on user's context, even when the policy is applied through computer-side processing.

For a GPP Environment Variable that suddenly stops resolving for only a subset of users, I would focus on the following areas:

1. Verify where the Environment Variable preference is configured

• User variables should typically be configured under:

User Configuration → Preferences → Windows Settings → Environment

• Computer variables should typically be configured under:

Computer Configuration → Preferences → Windows Settings → Environment

2. Review Item-Level Targeting (ILT)

• Open the Environment Variable preference item and review the Common tab.
• Check all configured ILT conditions, including:
  • Security Group membership
  • OU membership
  • Computer Name
  • Environment Variables
  • WMI Filters
  • Other targeting filters
• Changes to group membership, OU placement, or targeting conditions can result in the preference applying to some users but not others. Internal Group Policy learning content specifically identifies ILT as a key component of GPP processing and troubleshooting.

3. Verify the processing context

If the environment variable depends on user-specific data (group membership, user profile information, user environment variables, etc.), ensure it is evaluated in the appropriate user context.

• User-side processing runs under the logged-on user.
• Computer-side processing runs under a system or service account.
• Group Policy processing impersonates the user account when evaluating user-side policies.

In addition, GPUpdate creates separate processing tasks:

• Computer refresh runs as a system/network service context.
• User refresh runs as the logged-on user and executes gpupdate.exe /target:user.

Because of this design, user-context processing is a supported and expected behavior.

4. Generate GPResult or RSoP data

Run:

gpresult /h gpresult.html

Then review the report and verify:

• The GPO containing the Environment Variable preference is being applied.
• The preference item is not being filtered out by security filtering, ILT, WMI filtering, or scope-related issues.

It is a recommendation that GPResult and RSoP as primary troubleshooting tools when investigating Group Policy processing issues.

5. Review Group Policy operational logs and GPP diagnostics

Check:

• Event Viewer → Applications and Services Logs → Microsoft → Windows → GroupPolicy → Operational
• Application log for Group Policy Preferences events

Recent Group Policy improvements provide more detailed GPP diagnostics, including additional event logging that can identify exactly which object or network path caused processing failures.

6. Check for processing-related conditions

Several Group Policy processing conditions can affect whether preferences are applied, including:

• Slow-link detection
• Background vs. foreground processing
• Loopback processing
• User vs. computer refresh cycles
• WMI filtering

Please notes that some preference and Client-Side Extension behaviors can vary depending on processing mode and network conditions.

Since the configuration previously worked and still works for another user, the evidence points more toward a targeting, scope, filtering, processing, or permissions issue rather than a limitation that prevents user-context evaluation from working.

The next troubleshooting step would be to compare the GPResult/RSoP output from a working user and an affected user. Differences in applied GPOs, ILT evaluation, group membership, WMI filtering, or security filtering often reveal the root cause of these kinds of GPP issues.

Reference: Working with Group Policy Preference Items Using the GPMC | Microsoft Learn

Group Policy preferences in Windows | Microsoft Learn

I hope this information helps. If you find the response useful, please click Accept Answer.

Thank you for using Microsoft Q&A.