When managing a Windows Active Directory environment, it’s easy to assume that if a Group Policy Object (GPO) contains both Computer and User settings, everything inside it will apply automatically. Unfortunately, that’s not always the case.
I recently ran into an issue where a PowerShell startup script copied wallpapers correctly on every Windows 10 machine except one. The script worked perfectly when run manually, and the user account was the same across all machines, so at first it seemed like a script or permissions problem.
It turned out to be a classic case of GPO scope.
The Symptoms
- Startup script worked on most PCs.
- One computer never created the wallpaper folder or copied the files.
- The same domain user logged into all machines.
gpupdate /forcecompleted successfully.- No obvious errors in the script.
Running:
gpresult /scope computer /r
showed only:
Applied Group Policy Objects
-----------------------------
Default Domain Policy
The GPO containing the startup script was missing.
Understanding Computer vs User Configuration
A GPO can contain two independent sections:
- Computer Configuration
- User Configuration
Although they are stored in the same GPO, they are processed separately.
Computer Configuration
Computer settings apply when the computer starts.
Examples include:
- Startup scripts
- Security settings
- Windows Firewall
- Power management
- Windows Update policies
User Configuration
User settings apply when a user logs on.
Examples include:
- Folder Redirection
- Drive Maps
- Desktop settings
- User Registry Preferences
- Logon scripts
The Problem
The startup script was stored inside a GPO named Folder Redirection & Drive Maps.
That GPO was linked only to user OUs:
- Mortals
- OlderPCs
However, the affected computer account was located in:
OU=Computers
└── NetherRealm
Since the computer object wasn’t inside an OU where the GPO was linked, Windows never processed the Computer Configuration portion of that GPO.
The startup script simply never ran.
How to Confirm
Use:
gpresult /scope computer /r
If your GPO isn’t listed under Applied Group Policy Objects, the computer isn’t receiving it.
You can also generate the HTML report:
gpresult /h gpresult.html
This provides a more detailed breakdown of applied and filtered GPOs.
The Solution
Create a dedicated GPO linked to the Computers OU.
For example:
GPO – Computer Settings
Contains:
- Startup scripts
- Wallpaper deployment
- Computer security settings
- Power options
Once linked to the Computers OU, the startup script immediately began working on the previously affected machine.
Recommended GPO Structure
Keeping computer and user settings separate makes administration much easier.
Computer GPOs
Link these to your Computer OUs.
Examples:
- Computer Baseline
- Startup Scripts
- Windows Security
- Power Management
- Windows Update
User GPOs
Link these to your User OUs.
Examples:
- Folder Redirection
- Drive Maps
- Desktop Configuration
- Printers
- User Preferences
Benefits of Splitting GPOs
Separating Computer and User policies offers several advantages:
- Easier troubleshooting.
- Clearer GPO responsibilities.
- Reduced confusion over where settings apply.
- Simpler OU design.
- Faster identification of policy issues using
gpresult.
If a wallpaper deployment fails, you immediately know to check the Computer Configuration. If a mapped drive is missing, you know to investigate the User Configuration.
Final Thoughts
Although Windows allows both Computer and User settings within a single GPO, separating them is considered best practice in most Active Directory environments.
It makes policy processing easier to understand, simplifies troubleshooting, and avoids situations where a computer never receives a startup script simply because the GPO was linked only to a user OU.
Sometimes the problem isn’t the PowerShell script at all—it’s simply that the computer never receives the policy that tells it to run.