Windows Server Group Policy Troubleshooting: GPUpdate and RSOP Checklist

Confirm scope first

Verify the user or computer is in the expected OU and that the GPO is linked to that OU. Check security filtering, WMI filters and inheritance before changing the policy.

Run policy diagnostics

Use gpupdate /force, followed by gpresult /h C:\Temp\gpresult.html. Review the resulting report for applied and denied GPOs.

Check DNS and domain connectivity

Group Policy depends heavily on reliable domain DNS. Validate domain controller discovery with nltest /dsgetdc:domain.local and test access to SYSVOL and NETLOGON.

Check SYSVOL and replication

If one domain controller has stale policy data, compare SYSVOL contents and replication health. Do not manually copy SYSVOL folders between domain controllers.

Review event logs

Check GroupPolicy operational events on the client and replication events on domain controllers. Correlate timestamps with the failed policy refresh.

Validate the fix

Run gpupdate again, generate a fresh gpresult report and verify the exact setting on the target machine.