The fact that machine Windows GPOs are automatically revoked on shutdown can cause issues when there are settings that need to be present at all times (prime example: Windows shutdown scripts, for further details see this thread: https://forums.novell.com/showthread.php/495848-Windows-GPO-Shutdown-Script-not-working-properly)

I do not understand why machine GPOs are revoked at all, in my understanding, different users get different GPOs, but a machine usually has one GPO set that never changes (unless the admin wants to change some settings manually), but there are no settings that change depending on external variables (like for user GPOs changing users).

Even if for some reason it is necessary to have machine GPOs revoked automatically on shutdown in some scenarios, there should at least be an option (just a regkey to set) for admins to prevent that, as in my scenario this revoking of machine GPOs at shutdown makes things harder rather than easier, and I could imagine this to be the case in virtually every scenario which relies on the shutdown scripts mad possible by Windows GPOs.

by: Peter S. | over a year ago | Policy Mgmt