A GPO Isn't Applying to One OU, Even Though It Applies Everywhere Else

The error: A Group Policy Object works correctly for most of the domain, but one specific OU (or a subset of computers within it) never receives it — no error, it just silently doesn't apply.

Environment: Any Windows Server Active Directory domain using Group Policy.

Why this happens: GPO application is filtered by three independent mechanisms — security filtering (which groups/users the GPO applies to), WMI filtering (which machines match a condition), and OU linking/inheritance (including a Block Inheritance setting on the OU itself). Any one of these silently excludes a target with no error anywhere in the UI — it just looks like the GPO "isn't working" for that scope.

The fix:

1. Run gpresult /r directly on an affected machine — this shows exactly which GPOs actually applied and, critically, which were filtered out and why.
2. Check security filtering on the GPO itself: does the affected OU's computer/user group actually have Read + Apply Group Policy permissions?
3. Check for a WMI filter attached to the GPO — a filter written for one OS version silently excludes machines that don't match.
4. Check the OU itself for Block Inheritance, and check GPO link order/enforcement further up the tree.

One thing worth knowing: gpresult /r is the fastest path to the actual answer here — checking GPO links and filters one by one in the GPMC console, without first seeing what Windows itself says was filtered, wastes time confirming things that were already fine.