Computer Policies Not Applying

[Joanne]

Hi Guys,

 

got an issue with Server 2008 R2 and Windows 7. Just reimaged all the machines in this school using WDS. Computer policies are not applying to the machines, but User policies are applying fine. When I do a GPUPDATE /FORCE I get the following:

 

 

Microsoft Windows [Version 6.1.7601]

Copyright © 2009 Microsoft Corporation. All rights reserved.

 

C:\Users\sysadmin>gpupdate /force

Updating Policy...

 

User Policy update has completed successfully.

Computer policy could not be updated successfully. The following errors were enc

ountered:

 

The processing of Group Policy failed. Windows could not resolve the computer na

me. This could be caused by one of more of the following:

a) Name Resolution failure on the current domain controller.

b) Active Directory Replication Latency (an account created on another domain co

ntroller has not replicated to the current domain controller).

 

To diagnose the failure, review the event log or run GPRESULT /H GPReport.html f

rom the command line to access information about Group Policy results.

 

 

Event viewer shows this:

 

Log Name: System

Source: Microsoft-Windows-GroupPolicy

Date: 29/10/2013 15:19:05

Event ID: 1055

Task Category: None

Level: Error

Keywords:

User: SYSTEM

Computer: ICT-24.SMSJ.internal

Description:

The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following:

a) Name Resolution failure on the current domain controller.

b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

Event Xml:

1055

0

2

0

1

0x8000000000000000

6271

System

ICT-24.SMSJ.internal

1

1632

0

1623

5

Access is denied.

 

The "access is denied" bit is confusing. Computer is in AD fine and member of domain computers.

 

Looked on technet to no avail.

 

DNS is all working with reverse lookup zones.

 

Has anyone come across this before?

 

Any help much appreciated!

[Davit2005]

We've always found that we have to run the cmd as a Administrator as otherwise the Computer Policies don't seem to get updated.

[Joanne]

Nope sorry... same result running command prompt as administrator :-(

[Michael]

The clue is here:

 

The processing of Group Policy failed. Windows could not resolve the computer na

me. This could be caused by one of more of the following:

a) Name Resolution failure on the current domain controller.

b) Active Directory Replication Latency (an account created on another domain co

ntroller has not replicated to the current domain controller).

 

Make sure DNS is working on both your DCs (I'm speculating you have two or more), as this is most likely causing your DCs not to replicate.

 

Do your Active Directory structures look the same on both DCs?

[Joanne]

OK my colleague found the solution:

 

Download PSTools from microsoft.

 

He then created a script to run the command (assuming folder is in a mapped drive - in this instance x: and folder is named !PSTools)

 

cd x:\!PSTools

PsExec.exe -i -s cmd.exe

 

This may get blocked by anti virus. Sophos stopped it from running so had to allow it through.

 

Ran this and then it opens a new command prompt window, in which we typed:

 

rundll32.exe keymgr.dll, KRShowKeyMgr

 

The capital letters are essential in that line.

 

This opens a key manager box. Delete the key shown there. Run gpupdate /force, logoff ET VOILA! Policies are applied.

 

I think it was something to do with adding the image to the domain before sysprepping or saving a username password combo which had the machine name as the domain OR SOMETHING STUPID LIKE THAT.

 

Thanks for suggestions anyway.

 

If anyone else comes across this thread when trying to solve this issue, I hope I have helped by posting it here. 2 of us were googling for hours on the issue.

Edited October 30, 2013 by Joanne

[StevieM]

I had similar problems when I tried to deploy Office 2013 through a GP startup script. Some machines installed first time, others after a few restarts, still others after a forced GPUpdate. However, some machines would not update at all and I ended up doing manual installs. I don't understand as all the machines are identical and were created using the same image and all are present in AD. Still not got to the bottom of it, but I'll look at some of the solutions here and see if that makes any difference.