VDI machines not processing any Group Policy (User and Computer) – gpresult shows "Domain: Local"

Newbie275242 Lv1Posted Mar-17-2026 21:01

Hello everyone,

I am experiencing a strange issue with our Sangfor VDC non-persistent VDI environment, where no domain Group Policy is applied on newly created VDI machines.

Environment:
  • Sangfor VDC
  • Non-persistent VDI
  • Windows 10
  • Domain-joined machines
  • Sysprep is handled automatically by Sangfor VDC
  • Machine SIDs are different (verified)


Problems:
No User GPO or Computer GPO is applied to the VDI machines.
When running: gpresult /h report.html

Under Computer Details it shows:
  • Domain: Local
  • Site Name: N/A
  • Applied Group Policy Objects: N/A


or sometimes:

Domain: VDI-WIN10-XXXX
Domain Type: Local Computer
Event Viewer

We see the following event:

Event ID 8004
Group Policy processing completed in 0 seconds
Troubleshooting already performed
Domain join

Machines are correctly joined to the domain.

whoami /fqdn
echo %USERDOMAIN%
Both return correct domain information.

Secure channel
Test-ComputerSecureChannel
Result: True

Domain controller discovery
nltest /dsgetdcOMAIN
Works correctly.

Active Directory Site
nltest /dsgetsite
Returns the correct AD site.

SYSVOL access
The following paths are accessible:
\\DOMAIN\SYSVOL
\\DOMAIN\SYSVOL\DOMAIN\Policies

DNS
DNS resolution for the domain and DCs works correctly.

WMI check
wmic path win32_computersystem get domain,partofdomain

Result:
DOMAIN   TRUE
WMI repository is consistent.

Computer object location
The VDI computer objects are located in the correct OU where the GPOs are linked.

GPO testing
We created a simple User GPO (test wallpaper / simple setting) to verify processing.
Result: Not applied.

gpupdate
gpupdate /force

Policies are not processed.

Additional observation
The VDI template has Windows Firewall disabled, but when a new VDI is created the Domain firewall profile becomes enabled automatically.

Question
Has anyone experienced a similar issue with Sangfor VDC non-persistent VDI machines not processing Group Policy at all, even though:

Domain join is correct
Secure channel is working
SYSVOL is accessible
DNS and AD site detection are correct
Could this be related to service startup order (NLA / Netlogon / Group Policy Client) or something specific to Sangfor VDI provisioning?
Any suggestions would be greatly appreciated.

By solving this question, you may help 310 user(s).

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

Simone Eusebi Lv1Posted Mar-18-2026 19:20
  
Hi,
I think it is related to the fact that you are trying to create non-persistent VDI vms.
It could be that Windows 10 doesn't have enough time during its n-reboot to read and apply the Gpo that you have correctly linked and enabled in the OU where the computer object are located.
When the VDI is turned off then it's created from the template and, as first run, it needs to elaborate GPO.
Have you tried, once created VDI, to turn on Vms and try only to reboot them, without shutting them off?
I remember that Win10 need some reboot cycle in order to begin read and apply GPOs.

I Can Help:

Change

Board Leaders

lungluk...

Weekly Questioners