"Add the Administrators security group to roaming user profiles" still not allowing access

i'm doing testing of roaming profiles , have them working. administrator, cannot access each user's individual profile folder. have enabled gp setting "add administrators security group roaming user profiles" , done gpupdate on client pc i'm using first logon device user profile creation. gpresult shows gpo being applied, still doesn't grant me access.

i aware policy doesn't apply retroactively , folders created after gpo applied grant me access. i'm testing creating folder multiple times after i've created gpo. argument doesn't apply.

after digging, found old thread stated policy must configured on client pc user logging onto time in order work. tried doing , granted access after profile directory created.

but doesn't seem right answer. yes, solves problem. if have 500 computers in organisation, wouldn't mean you'd have enable setting on each , every 1 of them? no way admin want that.

can shed light on this?

ok, have solved issue.

in answer question configuring policy on potentially hundreds of computers, little confused being new server admin game. can configure client's policy settings client , work. there's easier way veteran sysadmins consider common sense: apply policy ou contains client pcs in ad users , computers.

by default, computer objects on server placed in computers container in ad when joined domain. since can't apply gpos container, had create ou them. here's did:

1. i moved domain computers out of default computers container , own ou. careful when doing this, may affect existing policies have set up. far, mine have been ok.
2. by following technet guide deploying roaming profiles on page, step 4 advises remove authenticated users security scope , replace group created earlier in guide. advise add authenticated users delegation tab of gpo domain computers correctly grab policy. (since update ms16-072, domain computers included authenticated users).
   
   here's part don't tell you: default, computer objects in domain not trusted delegation. makes adding authenticated users gpo delegation tab pointless. had go properties of each computer object in ad users , computers, click delegation tab , select "trust computer delegation service (kerberos only)". below:
   
   
   
   3. logged in test user on client pc , corresponding roaming profile directory created. able instantly access directory domain admin without issues.

maybe allowing trust delegation setting common knowledge among sysadmins, i'm still learning ropes , others in situation.

the strange thing though gpo working intended, doesn't show being applied in gpresult. @ point don't care.

Windows Server  >  Windows Server 2016 Essentials