Confirm scope first
Verify the user or computer is in the expected OU and that the GPO is linked to that OU. Check security filtering, WMI filters and inheritance before changing the policy.
Run policy diagnostics
Use gpupdate /force, followed by gpresult /h C:\Temp\gpresult.html. Review the resulting report for applied and denied GPOs.
Check DNS and domain connectivity
Group Policy depends heavily on reliable domain DNS. Validate domain controller discovery with nltest /dsgetdc:domain.local and test access to SYSVOL and NETLOGON.
Check SYSVOL and replication
If one domain controller has stale policy data, compare SYSVOL contents and replication health. Do not manually copy SYSVOL folders between domain controllers.
Review event logs
Check GroupPolicy operational events on the client and replication events on domain controllers. Correlate timestamps with the failed policy refresh.
Validate the fix
Run gpupdate again, generate a fresh gpresult report and verify the exact setting on the target machine.
Explore more TechRunbook guides
Browse practical troubleshooting guides, PowerShell scripts, checklists and infrastructure resources for your environment.
Browse all articles →