Changes made to the Default Domain Policies outside of GPOAdmin are not getting flagged as non-compliant (4225184)

Changes made to the Default Domain Policies outside of GPOAdmin are not getting flagged as non-compliant

In an environment with multiple domains, if a change is made to the Default Domain Controllers or Default Domain policy outside of GPOAdmin, the GPO in a different domain could be flagged as non-compliant instead of the GPO where the change occurred.

The watcher service does a search of GPOADmin for any registered item with the GUID of the policy that has been changed to mark it non-compliant. In this situation all Default Domain Policies have the same live GUID (regardless of the domain), so the watcher service will always mark the first one to return from the search as non-compliant. This is typically the first one registered. It will never mark the policy which would be returned second from the search as non-compliant. Currently the watcher service does not check the domain of the policy, only the live GUID when making this check.

WORKAROUND:

None

STATUS:

This has been identified as Defect VSTS019968 and is planned to be resolved in a future release of GPOAdmin.

VSTS019968