Strange application of group policies?

Question

Active Directory

Hello!
I have a cd on Samba4, a PC in a Win7 domain. I did
"Prohibit access to removable media" for some users, it worked. Now there is a need to give some users access to flash drives. I transfer the user to another OU (where there is no ban), I check on the virtual machine under this user - everything works. On a real machine, it became possible to read flash drives, and for writing it requires an admin password. Why is that? Group Policy was applied only per user.

Answer 1

See what gpresult /V /SCOPE USER produces on problem computers, and look for policy enforcement errors in the Application and Microsoft\Windows\Group Policy logs.