1

I am having an issue, where a GPO for Power Options doesn't apply to a certain OU even though I have linked it. This GPO is an exception from the Domain-Level GPO for Power Options and should only apply to the clients in this OU.

The GPO basically says to NEVER shutdown, hibernate or sleep and to also never allow the displays to go off. The problem I have is that it doesn't apply even though the GPO is listed when I perform gpresult. The client sleeps after 500 seconds.

And that is where my confusion starts, because the 500 seconds are nowhere declared, not even in the Domain-Level GPO.

When I look into the computersettings it shows, that the wanted settings are applied but it doesn't behave correctly.

I'll add pictures below so you can see exactly what I have fabricated. I hope you can help me with this issue and maybe explain the general dynamics so I can expand my knowledge about this topic.

This is the policy that needs to apply to the OU

This is the Domain Level Policy

The structure

Here is a screenshot of gpresult.html

and a screenshot of powersettings in registry

7
  • How did you determine it's sleeping after 500 seconds? Kernel-Power events in event viewer like ID 42 will show a sleep reason like button/lid, system idle, or application which might be helpful.
    – Cpt.Whale
    Commented Nov 29, 2023 at 17:33
  • On one of the problem clients, run gpresult /scope Computer /H c:\temp\gpresult.html and open the result file in a browser to see which GPO set each value to. Or generate an RSOP from the GPO editor
    – Cpt.Whale
    Commented Nov 29, 2023 at 17:37
  • I have checked gpresult /scope and it seems that, the GPO is received from the one I need, but the settings are the ones from the domain level. I've checked the GPOs on the client but they are not configured. Is this correct behaviour even though the html says they have been applied? Commented Nov 30, 2023 at 8:09
  • Is the Domain-level GPO set to "Enforced"? By default, A GPO linked to a specific OU will override a domain-level GPO. Where are you checking on the client? I believe these settings mostly get added into HKLM:\Software\Policies\Microsoft\Power\PowerSettings.
    – Cpt.Whale
    Commented Nov 30, 2023 at 16:19
  • I checked on gpedit.msc but I guess that was the wrong place. Now I've checked the registry on the folder you said and there are 2 values: ACSettingIndex and DCSettingIndex but both are set to 0. Commented Dec 4, 2023 at 14:17

1 Answer 1

0

From your screenshots, the GPO you want to apply is changing the settings for the power plan named "high performance", while the domain-level policy is changing settings for the plan named "balanced". They both try to set themselves as the active plan, so it might be a race condition.

You should probably use the same plan name if you want to overwrite the domain-level power settings.

OR, you might be able to use the Administrative Templates\System\Power Management\Select an active power plan GPO setting instead though, which shows up in the registry here:

Path  = HKLM:\Software\Policies\Microsoft\Power\PowerSettings\
Name  = ActivePowerScheme
Value = 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c (for high-performance)
2
  • Both options did not work. But I want to say thank you a lot for your efforts and informations I really appreciate it! Commented Dec 8, 2023 at 8:44
  • I also want to add, that I made another observation and it seems that no client in our company seems to get the power options applied through GPOs. Not even the ones that are in another OU, where no Power-GPO is added. Looks to me like there is a bigger issue going on. I might have to check more in detail about what is going on. I'll keep you updated if you want :D Commented Dec 8, 2023 at 8:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .