Anyone ever seen an issue like this? I've got some...
# _generalj
James Rankin
08/08/2025, 10:32 AMAnyone ever seen an issue like this? I've got some Windows 11 MCS-provisioned machines that when booted up, Group Policies appear to be applied (in that gpresult shows them as applied, and the correct Registry values exist). However, in the user's session, they don't apply (background is incorrect, logon screen is incorrect, App-V not working, etc.). What is weird is if you reboot the worker in vCenter (not Studio), the policies all appear correctly in the session at next logon.
I've been trying to work this one out in my head and can't fathom it out. If I apply one of the settings (e.g. the logon screen) to the master image directly (as in, bake in the settings), then it works OK at first logon. But it's not really feasible for us to start baking the entire set of GPOs into the master image, that's going to kind of defeat the object of having policies. Anyone seen an issue like this before?
j
Jeff Riechers
08/08/2025, 10:49 AMDo you have all the wait for network and everything set so that it isn't trying to login users with cached entries only?
j
James Rankin
08/08/2025, 10:50 AMAll set as far as I can tell - fast logon disabled, wait for network enabled, etc.
James Rankin
08/08/2025, 11:25 AMBut I'm not sure the "wait for network" policy is actually being set properly - as I said, some Computer level stuff also appears not to be applying (logon screen, etc.)
r
Rob Zylowski
08/08/2025, 11:26 AMMaybe they are logging in before the policies apply. Try using settlementperiodbeforeuse.
j
James Rankin
08/08/2025, 11:33 AMif I leave them for an hour, I get the same issue
r
Rob Zylowski
08/08/2025, 12:23 PMYea def weird
j
Jeff Riechers
08/08/2025, 12:53 PMSo I usually will just have my master image getting the policies baked in. That way if AD is ever having issues, which I have seen many times, I know users always get what they need. You could setup an autologon user account to login when the machine boots, do your gpupdates and app launches, logout and then start the broker service. I have a new procedure I am working on for that if you want to test it out.
Jeff Riechers
08/08/2025, 12:53 PMAlso, copilot offers this up, can you see this in your image?
Jeff Riechers
08/08/2025, 12:53 PM Copy code
New-ItemProperty -Path "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" -Name "SyncForegroundPolicy" -Value 1 -PropertyType DWORD -Force
New-ItemProperty -Path "HKLM\Software\Policies\Microsoft\Windows\System" -Name "GroupPolicyMinBackgroundRefreshInterval" -Value 0 -PropertyType DWORD -Forcen
Nick Casagrande
08/08/2025, 1:45 PMi put my gold vm in the prod ou before sealing with bis-f
💯 1
s
Steven Lemonier
08/08/2025, 2:27 PMas a startup script, we have this:
Remove-Item -Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol -Force
j
James Rankin
08/08/2025, 2:32 PMWell, seems like the Registry values Jeff offered up have made a difference. Seems this might be a commoner issue than I thought given all the replies...can't believe I've never come across it before
👍 1
James Rankin
09/15/2025, 11:15 AMThis worked for the last month or so. Now it seems to have stopped. Registry values are still in the master. Very odd
6 Views