Return
-
Title
Compliance action is taken on an unauthorized object automatically. -
Description
If the GPO is edited, an unauthorized modification is logged, then edited again to revert the change, the object in GPOADmin moves to x.1 Available, and a compliance action is logged. -
Cause
This can happen in the following scenario:
- Both changes were made without restarting the watcher service
- The change, and subsequent reversion of the change, cause the "hash value" to stay the same.
This hash value is stored by the watcher service on startup.This does not affect changes to GPO settings, it seems to be only relevant when the AD / SYSVOL version number do not change.
A change to the User or Computer Configuration enabled setting, and reverting to the original value, will cause this. -
Resolution
This is by design.