When This Happens
You just joined a PC to the domain. You reboot, wait forever at "Applying Group Policy...", and then it either times out or finally loads but none of the policies you set are there. Or maybe you run gpupdate /force and it just sits there for ten minutes before failing with "The processing of Group Policy failed." I see this at least once a month with small businesses using cheap DSL or a flaky VPN.
Root Cause
Group Policy is basically a file copy job. Your PC needs to connect to the domain controller (DC), authenticate, and then download the GPT.INI and policy files from the SYSVOL share. If the network path is slow, DNS can't find the DC, time is off, or the DC itself is overloaded, it stalls. Most of the time it's DNS or time sync — both are easy to miss.
The Windows Group Policy client caches a lot. If it can't reach the DC on the first try, it falls back to cached settings and logs that "delayed" message. So you think it's working, but nothing new applies. That's the real trap.
Fix Steps
Do these in order. Don't skip steps, don't guess. Start with the simplest thing.
1. Check DNS
Open a command prompt as admin. Run:
nslookup yourdomain.local
Replace yourdomain.local with your actual domain name. If it doesn't return the DC's IP address, your DNS is broken. Go to network adapter settings, set the primary DNS to the DC's IP address, and remove any public DNS like 8.8.8.8. I had a client last month using 1.1.1.1 as primary — Group Policy never worked until I fixed that.
2. Sync Time
Run:
w32tm /resync
If you get an error, the time is too far off. Set it manually to match the DC. Then run:
net time \\DCname /set /y
Replace DCname with your DC's hostname. Kerberos requires time within 5 minutes. If it's off by more, authentication fails silently, and Group Policy won't process.
3. Clear the Policy Cache
This is the step most people miss. The cache stores old settings and can get corrupted. Delete these folders:
C:\Windows\System32\GroupPolicy\Machine
C:\Windows\System32\GroupPolicy\User
Then from an admin command prompt:
gpupdate /force
This forces a fresh download. If it works now, the cache was stale.
4. Check SYSVOL Access
From the problem PC, open File Explorer and type this in the address bar:
\\DCname\SYSVOL\yourdomain.local\Policies
You should see a list of GUID folders. If you get an access denied or can't connect, the DC is down, the share is not shared, or permissions are wrong. Also check that the sysvol folder exists on the DC. Had a server once where sysvol wasn't replicated — both DCs had different copies. Pain.
5. Use gpresult to Diagnose
Run:
gpresult /h C:\temp\gpresult.html
Open the HTML file. Look for the section "Last Time Group Policy was Applied" and "Group Policy Objects Applied". If it says "Processing Time: 0 ms" or lists nothing, it didn't apply. Also check the "Status" column for errors like "Failed" or "Denied". This tells you which specific policy failed.
If It Still Fails
If you've done all that and it's still slow or failing, here's what I'd check next:
- Network latency: Ping the DC with
ping -t DCname. If it's over 100ms or has packet loss, your network is the problem. Fix that first. - DC load: On the DC, check Task Manager and Event Viewer for high CPU or disk usage. If the DC is a VM on a busy host, it might be throttled.
- Firewall rules: Group Policy uses RPC (port 135 and dynamic ports). Make sure the Windows Firewall on both ends allows this. Try temporarily disabling the firewall on the PC to test.
- Slow link detection: Group Policy has a "slow link" behavior where it skips some policies if network is slow. Check the policy setting: Computer Configuration -> Administrative Templates -> System -> Group Policy -> Group Policy slow link detection. Set it to 0 to disable slow link detection if you're on a LAN.
- Event Viewer logs: Look in Applications and Services Logs -> Microsoft -> Windows -> GroupPolicy -> Operational. Any red X's there give you the exact reason.
One last thing: if you're running Windows 10 22H2 or Windows 11 23H2, there's a known issue with Group Policy processing after a recent update. Microsoft released a hotfix in KB5034441 — make sure the PC is fully updated. I've seen that update fix things for two different clients.