The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →KB3163622 did not simply “break” Group Policy: Microsoft’s June 14, 2016 security update changed how Windows retrieves user Group Policy, and GPO permissions that relied on the old behavior may then prevent policies from applying. The documented fix is to review and correct the GPO’s Read permissions in Group Policy Management Console (GPMC), not to remove the security update.
What KB3163622 changed
Microsoft published KB3163622 as part of security bulletin MS16-072 on June 14, 2016. The bulletin addressed an elevation-of-privilege vulnerability involving a man-in-the-middle attack against traffic between a domain controller and a target computer. Microsoft said the update enforced Kerberos authentication for certain calls over LDAP. Microsoft Security Bulletin MS16-072
As an Amazon Associate I earn from qualifying purchases.
The operational change for Group Policy was that user policies began to be retrieved using the computer’s security context rather than the user’s. Microsoft describes this as an intentional security change. Microsoft Support: MS16-072 security update for Group Policy
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Why user Group Policy may fail afterward
Microsoft warns that “All user Group Policy, including those that have been security filtered on user accounts or security groups, or both, may fail to apply on domain joined computers.” The issue can arise when the GPO does not grant Read permission to the computer-side principal now involved in retrieving user policy. A GPO’s security filtering and its permissions therefore need to be checked together; changing filtering alone may not provide the required Read access. Microsoft Support
#1 Best Overall
How to check and correct GPO permissions in GPMC
- Open Group Policy Management Console. Locate the affected Group Policy Object (GPO) and inspect its delegation or security-filtering configuration.
- Check Read permission. If the GPO is missing Read permission for Authenticated Users, Microsoft’s documented remedy is to add Authenticated Users with Read permission.
- If security filtering is used, check Domain Computers. Microsoft instructs administrators to add Domain Computers with Read permission when security filtering applies. Keep the intended filtering configuration in view; the remedy is to ensure the computer-side principal can read the GPO, not to grant broad access without considering the policy’s scope.
- Account for loopback Merge, if configured. For a GPO addressed through Loopback Processing in Merge mode, Microsoft says to include the specific users and computers for which that GPO is intended in the Security Filtering area. This is a configuration-specific check, not a universal replacement ACL.
- Recheck policy application. After correcting the relevant permissions, verify whether the affected user policy applies on the domain-joined computer.
Microsoft documents the permission remedy in its MS16-072 Group Policy guidance and related Microsoft technical blog.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to avoid
Do not treat uninstalling KB3163622 as Microsoft’s documented fix. The update was intended to protect against a security vulnerability; the supported troubleshooting direction is to correct the GPO permissions for the changed retrieval context. When applying this guidance to a legacy Windows installation, also verify that platform’s current support status and applicable servicing requirements before making deployment decisions.
Quick Recap
Rank #4
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
Rank #3
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
