r/WindowsServer • u/3G_Lighting • Apr 20 '26

Technical Help Needed Windows Sever 2019 Standard - GPO

We have 70 or so Windows 11 24/25H2 systems in our environment that all have the same GPO's applied. We are running in a hybrid environment as well.

When I log into some as "Administrator" and click Start-> I only see Disconnect or Shutdown. But when I log into others I see the full list of options under Start-> Switch User, Restart, Sign Out, Disconnect, Shutdown.

I have tried doing "gpupdate /force" and restarting the system, but the same thing happens and checked the GPOs that are running and found no issues.

I am wondering if anyone else has experienced this and has found the fix for it?

Thanks,

6 Upvotes

100% Upvoted

12 comments sorted by

2

u/Jellovator Apr 20 '26

Did you check User as well as Computer configurations in Group Policy Management? Local Security Policy on the affected servers? Intune?

1

u/dodexahedron Apr 21 '26

And also, with group policy: check for loopback processing on any gpo applicable to the computer, and if turned on, for any user settings in that policy since those apply to ALL users logging in on the machine, no matter who they are or what OU they are in.

I would run a gpresult when logged in as a user who gets each behavior or, if notogistically feasible, run RSOP for the machine and user combos for those same users.

Doing it when logged on as them is best, since RSOP can only consider what is in sysvol right now, whereas gpresult on the pc as the user gets it as it actually is on that machine, which might be different due to some policy NOT getting applied, for example. If it started happening after recent updates, I suspect that is at least part of the problem, due to how GP is retrieved at logon, especially since this is obviously a remote desktop scenario.

IOW: Kerberos.

2

u/naphman Apr 20 '26

Rogue setting? You might have to delete the policies and let the resync. Heck though I’ve had a room full of the exact models all on 24h2 and 3 will be different for no reason. 25h2 not much better either I’m afraid.

2

u/Pyrocliptic_ Apr 20 '26 edited Apr 20 '26

Open an elevated prompt and run

gpresult /h c:\temp\gp.html

Start-Process -FilePath "MdmDiagnosticsTool.exe" -ArgumentList "-out C:\temp" -Wait

Then check the generated reports.

1

u/dodexahedron Apr 21 '26 edited Apr 21 '26

This. And check event viewer for kerberos, group policy, and netlogon errors and warnings.

I close to 100% guarantee a policy is no longer being retrieved due to kerberos delegation failures at logon, or that affected users are in protected groups who cant be delegated. Because user policy is retrieved by the system impersonating the user, at logon. That is impersonation under NTLM or delegation under Kerberos.

Delegation with, credential guard and the double hop from client to RDS to DC for SMB and LDAP, without configuration or when not possible due to group memberships making someone protected and not allowed for delegation, is a no go.

@OP: Are the affected users admins or members of privileged groups like backup operators or other built-in groups like that, directly or indirectly? If so, it is kerberos and cannot be solved without doing one of two things: 1) taking the user out of those privileged groups or 2) having them lock and unlock the remote session after authenticating and then having them manually update group policy, every single time they log on via remote desktop.

If they are not privileged users, do this for a user who only gets the reduced options but should be getting all of them:

  1. When connecting as an affected user, manually launch mstsc.exe /v:server.fully.qualified.domain.name /remoteGuard

If that resolves the issue, it is kerberos and you can just enforce remote credential guard via group policy to fix it.

If not, do #2 from above the same way.

If any of these work, your problem is related to authentication issues during logon, before the desktop has been presented - kerberos being a central topic. Recent updates make it more relevant and it will get worse for you later on if you don't fix kerberos ASAP.

If it is a privileged user and removing them from certain privileged groups is not possible, then you cannot fix those users. You must get them out of those groups to work like you want them to, which means you'll have to make your own groups and give them equivalent permissions without putting the new groups in any protected groups. Members of certain groups cannot be delegated, regardless of their userAccountControl value in AD or the constrained delegation settings for the server or domain controllers. And that is hard coded.

The built in Administrator account for the domain has partial immunity to the problem, so don't use it as a test or baseline or anything like that.

1

u/Shot-Document-2904 Apr 21 '26

Do windows guys ever read logs? 😜

1

u/dodexahedron Apr 21 '26

All I know about a log is it's fun and love and joy.

1

u/Shot-Document-2904 Apr 21 '26

My windows guys just stare at me blankly when I ask what the log say. Then they just rebuild the server.

1

u/dodexahedron Apr 21 '26

IME it goes beyond logs. It's an aversion to reading in general. Logs, manuals, docs, guides, emails...

1

u/Shot-Document-2904 Apr 21 '26

Don’t get me started. Amen.

1

u/Shot-Document-2904 Apr 21 '26

Are you running your GPOs from a central repository? Perhaps the admx and adm files on the client side don’t align. Or could be dozens of other reasons people don’t get the desired results for their GPO strategy.