question

Use GPResult to figure out what's going on - it will not only tell you what the end result policy is, but also it will tell you which GPO 'wins'

From an Administrative Command Prompt on an affected client, run the following:
gpresult /h gpo.htm

You can also use gpmc.msc to see - click on an OU, click Group Policy Inheritance tab. The closer the GPO is to #1, the more it will take precedence over others behind it.

Are you suffering from the missing Authenticated Users in the delegation tab of your new GPO? You've removed Authenticated Users from the scope tab (that's fine) but then you have to add the Authenticated users group to your Delegation tab with READ permissions....

It has to do with a Windows Update released in June 2016 - MS16-072 - https://support.microsoft.com/en-us/kb/3163622

Taken from Emin's blog - https://p0w3rsh3ll.wordpress.com/2016/06/16/fix-gpo-permissions-before-applying-ms16-072/

To quickly display GPO names that don't have the Authenticated Users group, you can do:

Powershell

 Get-GPO -All | ForEach-Object {
     # Test if Authenticated Users group have at least read permission on the GPO
     if ('S-1-5-11' -notin ($_ | Get-GPPermission -All).Trustee.Sid.Value) {
         $_
     }
 } | Select DisplayName

To add back the Authenticated Users group with Read Permissions on the Group Policy Object (GPO), you can do:

Powershell

 Get-GPO -All | ForEach-Object {
     if ('S-1-5-11' -notin ($_ | Get-GPPermission -All).Trustee.Sid.Value) {
         $_ | Set-GPPermission -PermissionLevel GpoRead -TargetName 'Authenticated Users' -TargetType Group -Verbose
     }
 }

Now, every GPO has a permission set for the 'Authenticated Users' group and to check what permission is set for this group, you can do:

 Get-GPO -All | ForEach-Object {
     [PsCustomObject]@{
         DisplayName = $_.DisplayName
         Permission = ($_ | Get-GPPermission -TargetName 'Authenticated Users' -TargetType Group).Permission
     }
 } | Out-GridView -Title 'Authenticated Users permissions'

having READ permission only allows a user to run
gpresult /h gpo.htm
and SEE the name of the GPO that failed to apply. It doesn't apply it during processing, however it allows the visibility for troubleshooting.
I suggest Authenticated Users, but you can also do just Domain Computers (but you may lose the visibility)

Watch the first video by Dan Holme, starting at time 15:52

https://www.ajtek.ca/guides/role-based-access-security/

I recommend watching the entire video along with the other videos on that page by Dan Holme.