Cannot Access group policy objects

[timbo343]

When forcing an update in for group policy through cmd.. i check the event viewer after it has finished updating and i see an error message..
Error SceCli
Security policy cannot be propagated. Cannot access the template. Error code = -536870656.
\\Domain\sysvol\Domain\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\Machine\Microsoft\Windows NT\SecEdit\GptTmpl.inf.
Ive had a look at
http://support.microsoft.com/?kbid=258296

done what it has said but still no joy.. any one beable to help me out

Tim

[Geoff]

Is replication functioning?

[timbo343]

seems to be

[plexer]

What tests have you done to check it is?

Ben

[timbo343]

well looking at the policies on other servers

[Geoff]

Run dcdiag on your DC's. Check the event log for errors and warnings.

[timbo343]

Test results ::

Domain Controller Diagnosis

Performing initial setup:
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\SETH
Starting test: Connectivity
......................... SETH passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\SETH
Starting test: Replications
......................... SETH passed test Replications
Starting test: NCSecDesc
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes All
access rights for the naming context:
CN=Schema,CN=Configuration,DC=shs,DC=com
Error BUILTIN\Administrators doesn't have
Replicating Directory Changes All
access rights for the naming context:
CN=Schema,CN=Configuration,DC=shs,DC=com
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes All
access rights for the naming context:
CN=Configuration,DC=shs,DC=com
Error BUILTIN\Administrators doesn't have
Replicating Directory Changes All
access rights for the naming context:
CN=Configuration,DC=shs,DC=com
......................... SETH failed test NCSecDesc
Starting test: NetLogons
......................... SETH passed test NetLogons
Starting test: Advertising
......................... SETH passed test Advertising
Starting test: KnowsOfRoleHolders
......................... SETH passed test KnowsOfRoleHolders
Starting test: RidManager
......................... SETH passed test RidManager
Starting test: MachineAccount
......................... SETH passed test MachineAccount
Starting test: Services
......................... SETH passed test Services
Starting test: ObjectsReplicated
......................... SETH passed test ObjectsReplicated
Starting test: frssysvol
......................... SETH passed test frssysvol
Starting test: frsevent
......................... SETH passed test frsevent
Starting test: kccevent
......................... SETH passed test kccevent
Starting test: systemlog
......................... SETH passed test systemlog
Starting test: VerifyReferences
......................... SETH passed test VerifyReferences

Running partition tests on : Schema
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom

Running partition tests on : Configuration
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom

Running partition tests on : shs
Starting test: CrossRefValidation
......................... shs passed test CrossRefValidation
Starting test: CheckSDRefDom
......................... shs passed test CheckSDRefDom

Running enterprise tests on : shs.com
Starting test: Intersite
......................... shs.com passed test Intersite
Starting test: FsmoCheck
......................... shs.com passed test FsmoCheck

[Geoff]

There you go then. Your replication is broken.

[timbo343]

ok how do i fix it??

[Geoff]

You need to find out where it's failing first. What does the Replication event log say?

[timbo343]

first of all.. dont want to sound thick but how do i find the log ??

[timbo343]

might have found it
Ntfrs

[Geoff]

1) Login to DC
2) Run Event Viewer
3) Select 'File Replication Service'

[timbo343]

ok thanks... got this every morning...
One hades dc:
source: NtFrs
Following is the summary of warnings and errors encountered by File Replication Service while polling the Domain Controller Hades.shs.com for FRS replica set configuration information.

On seth dc:
The File Replication Service has enabled replication from ISIS to SETH for c:\windows\sysvol\domain after repeated retries.


On isis dc:

The File Replication Service is having trouble enabling replication from SETH to ISIS for c:\windows\sysvol\domain using the DNS name seth.shs.com. FRS will keep retrying.
Following are some of the reasons you would see this warning.

[1] FRS can not correctly resolve the DNS name seth.shs.com from this computer.
[2] FRS is not running on seth.shs.com.
[3] The topology information in the Active Directory for this replica has not yet replicated to all the Domain Controllers.

This event log message will appear once per connection, After the problem is fixed you will see another event log message indicating that the connection has been established.

[Geoff]

Ok, does your primary DNS IP as setup on your DC's point at the other DC or itself?