Group policy applies even if I block it from Delegation tab

hi.

i block "wpad proxy" policy delegation tab. put permission group email_allow ->  read:no.

everything worked pretty well. 1 day policy started apply clients.

gpresult clients, , group policy results wizard show same result.

rsop data domain\username on computername : logging mode ----------------------------------------------------------------  os configuration: member workstation os version: 6.1.7601 site name: n/a roaming profile: n/a local profile: c:\users\username connected on slow link?: no   user settings --------------     cn=username,ou=subou1,ou=ou1,dc=loc,dc=domain,dc=com     last time group policy applied: 6/20/2016 @ 8:39:52     group policy applied from: dc1.loc.domain.com     group policy slow link threshold: 500 kbps     domain name: domain     domain type: windows 2000      applied group policy objects     -----------------------------         usertile         bginfo         default domain policy         user_comp_assign         flashplayer         admin_shares         allow remote assitance         firefox         firewall         install_certificates         java32         localadmin         netsupport         reader         klmover         wpad proxy
the user part of following security groups
    ---------------------------------------------------
        domain users
        everyone
        builtin\users
        nt authority\interactive
        console logon
        nt authority\authenticated users
        this organization
        local
        email_allow
        medium mandatory level

the weird thing here that computer policies are displayed here in user settings. flashplayer, admin_shares gpos are only computer settings policies. should not here. actually, should (took working computer):

user settings --------------     cn=username,ou=subou1,ou=myou1,dc=loc,dc=domain,dc=com     last time group policy applied: 6/17/2016 @ 2:35:15 pm     group policy applied from:      dc1.loc.domain.com     group policy slow link threshold:   500 kbps     domain name:                        domain     domain type:                        windows 2008 or later      applied group policy objects     -----------------------------         usertile         bginfo         user_comp_assign         netsupport         no_proxy

however, figured out security settings of gpo applied successfully (denies access gpo). client computer trying access policy \\loc.domain.com\sysvol\loc.domain.com\policies\{0a7a5390-ead6-4deb-ba95-2f3ea4dd2861} , don't have permission. so, physically clients can't access policy. though applied.

dcdiag - no errors on every dc.

finally, found solution.

there update ms16-072 \ kb3163622. it fixes man-in-the-middle theoretical attack flaw in windows. , changes "security context user group policies retrieved" organizations using group policy.

to fix gpo security issue need add “authenticated users” group “read” permissions on affected group policy objects (gpos).

for further information read following article: https://blogs.technet.microsoft.com/askds/2016/06/22/deploying-group-policy-security-update-ms16-072-kb3163622/

in case, gpo's applied if block them security tab.

to fix need add security group "read" permission and deny "apply group policy" permission on gpos.

that's how block gpos applying groups.