Security in depth · Unit 24 · Lesson 12 of 14

Configured policy is not applied policy

Use scope, security filtering, and device evidence to distinguish policy intent from application.

3 minreadyShort lesson

Helpful before thisActive Directory

See all lessons in this topic

After this lesson you can

Explain why a linked computer policy can be filtered out without proving the device has no equivalent protection.

The policy editor shows a decision someone made; a device report shows whether that decision reached a computer.

Scope has several gates

A Group Policy Object, or GPO, can contain computer and user settings. Linking it to an organizational unit establishes potential scope, not guaranteed application. For security filtering, the relevant identity needs both Read and Apply Group Policy permissions.

Processing, inheritance, filters, and competing settings can affect the result. This example isolates computer-side security filtering so that one explanation can be evaluated without guessing the others.

Follow configured intent through scope and processing to the resulting setting. A skipped policy alone does not establish the absence of that setting.

Supplied record: two library kiosks

The fictional library approves a 600-second inactivity limit for both kiosks.

Objects: Kiosk-A and Kiosk-B are in the Kiosks organizational unit.
GPO: linked to Kiosks; computer configuration enabled.
Kiosk-A permissions: Read and Apply Group Policy.
Kiosk-B permissions: Read only.
Current reports: A applied this GPO and has a 600-second limit; B skipped it because of security filtering.
B’s effective inactivity limit: not supplied.

Assume current replication, successful connectivity, no WMI filter, and no inheritance or precedence complication. The listed permissions are effective permissions for the computer accounts. Kiosk-B lacks the required Apply permission, which explains this GPO’s nonapplication. It does not prove B has no inactivity lock from another source.

Close the evidence gap

Your review should separate approved scope, processing result, and effective configuration. The owner can approve correcting the narrow filter scope for B. Acceptance then requires a fresh processing result and B’s actual setting, while preserving A’s intended behavior.

Check yourself

No timer. No penalties. Read the explanation and try again whenever you like.

Kiosk-B has Read without Apply Group Policy, and its report says this GPO was security-filtered. What is supported?

Show the answer
Correct answer: The missing Apply permission explains this GPO being skipped; Kiosk-B’s effective inactivity limit remains unverified. Computer security filtering requires both Read and Apply Group Policy. A skipped GPO does not by itself reveal the resulting value from other configuration.

Try it

WriteWrite a two-device review showing intended scope, Read and Apply permissions, processing result, and known effective setting. Mark missing evidence explicitly and define acceptance after an approved filter correction.

References