For a GPO to work, both "Authenticated Users" and "Domain Computers" must have "Read" rights. On a Policy Object, go to "Delegation/Advanced"" and set those rights accordingly.