By default the first time a user logs in, most of their group policies aren’t applied to speed up the login process. This means users might have to login a couple of times before their group policy applies.
To disable this behaviour:
Computer Configuration \ Administrative Templates \ System \ Logon \
Always wait for the network at computer startup and logon