Restituisci
-
Titolo
Watcher service is not setting GPOs as non compliant when modifications are made outside of GPOADmin -
Descrizione
Watcher service is not automatically setting GPOs to non compliant. The compliance wizard does report the changes. -
Risoluzione
If using a minimum permissions service account ensure the service account has the below access outlined in the Minimum Permissions guide:
The Watcher Service requires that the service account has the “Replicating directory changes” permission on the Default Naming Context (DC=domain, DC=com) and the Configuration Context (CN=Configuration, DC=domain, DC=com) for this object and all descendents.
If permissions have been confirmed, go to the properties of the GPO and check to see if there are any automatic selections made on the Remediation tab. For example, the GPO could be set to "Incorporate Live" so the watcher service will see the non compliance and then automatically remediate this with Incorporate Live.