If you are unsure if a WMI filter is causing an issue, check out our guide to WMI filters and Group Policy. In order for a GPO to apply, the object (a user or a computer) will need two GPO permissions. By default, an object added to the scope tab receives both of these permissions.That is why every object can apply a GPO is authenticated users is under security filtering.
The other strategy for system updates is to stick to maintenance times, and the best way to do that is to assign this setting at the Organizational Unit (OU) level.
In this configuration, an OU would be created for a category of like servers.
Microsoft has provided great guidelines and tools in order to troubleshoot.
Let’s look at the top ten issues that can stop Group Policy from being applied.
If the GPO configures a user side setting, it needs to be linked to the OU containing the correct user.
There are certain cases where you can do some crazy linking. Remember, GPOs cannot be linked to an OU that just contains security groups. By default, a GPO is filtered to authenticated users. When new software/updates what ever need to be installed, the standard practice has been to move the server(s) to a different OU (Computers) that doesn't have these restrictions, and reboot it to be sure the Group Policy settings are updated and the server is in a pretty clean state for install. The change is replicated to all other domain controllers in the Active Directory.Be sure to check out the other articles in this series for more in-depth Group Policy troubleshooting.The most common issue with Group Policy is a setting not being applied.This GPO is linked to an OU named Domain Sites, applies to Authenticated Users, and doesn’t have a WMI Filter linked to it.