Solution:
Root Cause: Missing Computer Object Security Permissions on GPO Scope
By default, Group Policy objects apply security filtering to
Authenticated Users, which includes both user and computer objects. However, if administrators restrict security filtering strictly to user groups (e.g., removing
Authenticated Users and adding only specific user security groups), the computer account itself loses permission to read the GPO during the computer startup phase, causing loopback processing to fail entirely.
Step-by-Step Fix:
1Adjust Security Filtering in GPMC:
Open Group Policy Management Console and select your loopback GPO.In the Scope tab, look under Security Filtering.Ensure that Authenticated Users is listed, OR explicitly add the computer security group / Domain Computers alongside your target user groups.2Verify Delegation Read Rights:
Click the Delegation tab, click Advanced, and ensure Read and Apply Group Policy permissions are explicitly checked for Domain Computers or the specific computer security group.