Security Group Targeting in GPO (Mapped Drive)

Topic

New Reply

Wondering if anyone else has the same issue as me, when adding new mapped drives to a gpo, and item level targeting it to a security group I’ve found that the “User in Group” is greyed out and it’s defaulting to  Computer in group, even when selecting a security group that only has users in.

Any preference that already has security group targetting is still present, but again the “user in group” is greyed out but selected

Thanks in Advance

RichE

Reply | Quote

Replies

We are encountering the same issue.

Reply | Quote

did some online research.  looks to be related to august update KB041578

Reply | Quote

AFAIK, we have not deployed KB041578 and are still experiencing no User\User group selection in User section of GPP’s.

Reply | Quote

What about if you do security filtering on the GPO itself and not in the GPP item level targeting?

Reply | Quote

KB in question looks to be KB5041578

Reply | Quote

According to reports on Günter Born’s Blog

August LCU of different OS causing this.

Reportingly WS 2019 and 2022. Different KBs.

They also report it will only break the GPP edit but untouched GPOs with GPP remain doing their job.

 

Very thankfully. If this was not the case this is worth a Patch defcon 2. Many using this not only for SMB file shares.

Reply | Quote

hello

i had the same problem came looking for an answer. the born blog mentions editing the xml.   i found a quicker workaround  IF you have an existing drive mapped with the user targetting, you can right click and copy paste. Then simply edit the copy. I just tested this and it worked.

Reply | Quote

FYI: Tracking a GPPrefs **EDITING** problem which came into PolicyPak support-land; but appears to be from KB041578. The “USER IN GROUP” is grayed out on COMPUTER side. Workarounds are (a) Copy an existing item with ILT already in it and edit contents (don’t edit ILT). Or, hand-edit the ILT from XML (takes advanced skills… but do-able.) NOTE Existing policies are not affected. Only CREATING NEW and EDITING of EXISTING policies affected.

See https://x.com/jeremymoskowitz/status/1827088704248119593

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Dear gurus, I am not an expert but I found a work around by experimenting

I was creating GPO for Drive mapping under User Configuration -> Preferences with Item-Level Target, where User in OU was greyed out so I had to use Computers in OU on Server 2022, which ofcourse failed and drive didn’t map, I used gpresult and found that GPO applied but failed due to unknown error, ofcourse I knew why it failed because had chosen Computers in OU in ILT.

I started reading on the blogs and came to know that it is a BUG in one of the updates on Server 2022, so I had an idea

and I used a Server 2012 R2 to recreate the SAME GPO for Drive mapping and item-level Target using Users in Group. I compared the 2 XML files and found that

in <Filters>, by changing userContext=”1″, it works for user in Group (even though it is still greyed out) . I am pasting both XML for your review

Server 2012R2 (“user in OU” Enabled)
<?xml version=”1.0″ encoding=”utf-8″?>
<Drives clsid=”{XXXXXXXXXX}”><Drive clsid=”{XXXXXXX}” name=”G:” status=”G:” image=”0″ changed=”2024-09-05 19:32:04″ uid=”{XXXXXX}” bypassErrors=”1″><Properties action=”C” thisDrive=”SHOW” allDrives=”SHOW” userName=”” path=”[path]” label=”DeptShared” persistent=”0″ useLetter=”1″ letter=”G”/><Filters><FilterGroup bool=”AND” not=”0″ name=”[domain name\folder]” sid=”XXXXX” userContext=”1″ primaryGroup=”0″ localGroup=”0″/></Filters></Drive>

Server 2022 (“user in OU” Disabled/Greyed out)
<?xml version=”1.0″ encoding=”UTF-8″?>
<Drive uid=”{YYYYY}” changed=”2024-09-05 20:24:31″ bypassErrors=”1″ image=”0″ status=”Z:” name=”Z:” clsid=”{YYYYY}”><Properties letter=”Z” useLetter=”1″ persistent=”0″ label=”abc” path=”[Path]” userName=”” allDrives=”SHOW” thisDrive=”SHOW” action=”C”/>
<Filters><FilterGroup name=”[Domainname\folder]” localGroup=”0″ primaryGroup=”0″ userContext=”0″ sid=”YYYYY” not=”0″ bool=”AND”/></Filters></Drive>

1 user thanked author for this post.

pabby

Reply | Quote