GPP item-level targeting filter not working as expected

Question

I am trying to set the Internet Explorer homepage via user Group Policy Preferences (GPP) registry setting for a very specific group of users.  I am using item-level targeting to accomplish this but am having trouble getting the logic working as expected.
Here is my item-level targeting filter:
The user is a member of the security group CONTOSO\FireRescueDept
AND this collection is false
     The user is a member of the security group CONTOSO\EmergencyManagementDept
     OR the user is a member of the security group CONTOSO\PublicSafetyDivision
The user in question is a member of both CONTOSO\FireRescueDept and CONTOSO\EmergencyManagementDept.  I believe this means that this particular registry GPP setting should NOT apply to the user in question and that is the outcome I desire.
Here is how I'm thinking about it:
The user is a member of CONTOSO\EmergencyManagementDept; therefore, "The user is a member of the security group CONTOSO\EmergencyManagementDept" evaluates to TRUE.
Since the other item in the collection is connected with the boolean OR operator, the collection evaluates to TRUE regardless of the evaluation of "The user is a member of the security group CONTOSO\PublicSafetyDivision."
The item-level targeting filter is looking for the collection to evaluate to FALSE.  Since the collection has evaluated to TRUE, the evaluation "This collection is false" is FALSE.
Because of the AND operator in front of "This collection is false", both "The user is a member of the security group CONTOSO\FireRescueDept" and "This collection is false" must evaluate to TRUE in order for the item-level targeting
filter to determine that the user in question to apply the GPP setting the filter is attached to.  However, since "This collection is false" has already evaluated to FALSE, the filter as a whole should evaluate to FALSE and this GPP setting
should not apply.
However, according to gpresult it does apply.
Please advise.  I want this particular setting to apply to users in the CONTOSO\FireRescueDept group unless they are a member of CONTOSO\EmergencyManagementDept and/or CONTOSO\PublicSafetyDivision.

Answer 1

Am 21.05.2013 16:22, schrieb Scott W. Sander:
> Does item-level targeting not work with Universal security groups
> because the group policy client isn't able to determine that the user
> is a member of groups of that type?
In my experience, it DOES work with universal groups... Are you
suffering from token bloat? How many groups is the user a member of?
http://blogs.technet.com/b/shanecothran/archive/2010/07/16/maxtokensize-and-kerberos-token-bloat.aspx
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!