Security Filtering shows none on denying apply on a single user

Question

Security Filtering shows none on denying apply on a single user

Aakarsh Gupta 0

I have a group policy that has Authenticated Users and SYSTEM in security filtering. Basically I want it to apply to all users apart from 3 which are the admins. They are part of a group called IT which I was earlier added in delegation and denying apply, this would cause the GPO to stop working completely as somehow it would stop Security Filtering to work and would show none in the Settings page. I then resorted to adding a single user directly and denying the apply and that too led to the same thing. I am unsure how denying the application to a single user is causing the whole thing to stop working.

1 answer

Your answer

Answer 1

Hello Aakarsh Gupta

When using Group Policy, security filtering and delegation must be handled carefully to avoid unintended behavior. If you deny “Apply Group Policy” to a group or user that’s also part of the “Authenticated Users” group, it can cause the policy to become ineffective or appear as “none” in the settings view. This is because denying permissions at the security filtering level overrides any allow entries, and if the remaining filter doesn’t resolve to any valid target, the GPO won’t apply.

Adding a single user and denying “Apply” can also break the filtering if that user is part of a broader group like “Authenticated Users” — the conflict causes the GPO engine to skip processing. A better approach might be to create a new group that includes all intended users except the IT admins, and use that group in the security filtering instead of relying on exclusions.

I hope this helps clarify the behavior. If you found this answer useful, feel free to hit “Accept Answer” so others can benefit too 🙂.

Harry.

Share via

Security Filtering shows none on denying apply on a single user

1 answer

Your answer