If I try to add a newly created (via joining) computer or a newly
created group to the security filter of a GPO nothing happens. If I add
them on the delegation page they get added, but are only shown as SIDs
with a question mark. If I do the same with older objects all is
working as expected.

I already compared older and newer objects, but could only find one
difference between them: the newer ones are missing the 'Used by'
attribute, which is set to the domain ou (and sometimes other contexts,
too) in the older ones.

If I use them in NTFS filesystems in the security tab they work without

DSfW server is OES2SP3 with latest patches.

Does anybody have any ideas ?
W. Prindl