GetGPOList function does not return all GPOs in Windows 7, in Windows Server 2008 R2, in Windows Vista or in Windows Server 2008
Consider the following scenario:
- You have a computer that is running one of the following operating systems:
- Windows Vista
- Windows 7
- Windows Server 2008
- Windows Server 2008 R2
- You use the LocalSystem account to run a service on the computer.
- The service calls the GetGPOList function to query all Group Policy objects (GPO) that are applied on a computer.
- The Authenticated Users group is removed from the access control list (ACL) in an applied GPO.
In this scenario, the GetGPOList function does not return all applied GPOs. The function returns only GPOs that have the Authenticated Usersgroup in the ACL of the GPO.
For more information on this issue, including potential causes, workarounds, and resolutions, see: Microsoft KB Article KB2553771.