GPO won't work/apply

There was a change in GPOs recently (security issue that was corrected in Windows Update KB3163622) that I'm pretty sure is what you're running into.

After the new security change, if Authenticated Users is not in the Delegation tab, the GPO won't work (period).

When you remove Authenticated Users from the Security Filter via the GUI, it ALSO removes it from the Delegation tab. This used to not be a problem, now it is. :)

So, after you remove Authenticated Users from the Security Filtering, add them (back) into the Delegation tab (Read-only access should be enough), and then continue editing you Security Filter as you wish.

How to identify GPOs with issues:

In case you have already installed the security update and need to identify Group Policy Objects (GPOs) that are affected, the easy way is just to do a simple gpupdate /force on a Windows client computer and then run the gpresult /h new-report.html -> Open the new-report.html and review for any errors like: “Reason Denied: Inaccessible, Empty or Disabled”

Source: https://superuser.com/questions/1106551/gpo-only-works-on-authenticated-users
Source: https://blogs.technet.microsoft.com/askds/2016/06/22/deploying-group-policy-security-update-ms16-072-kb3163622/