Domain policies not being pulled across

[badsurname]

Hi all, I have an interesting problem and would like to see if anyone else is experiencing the same issue and perhaps see if there is a known solution.

 

We have an issue at present with a number of computers on the network randomly deciding not to pull all of the network policies across. Our servers are running Windows Server 2003 SP2 and the majority of the PCs are running Windows XP SP2 with the occasional SP1 machine that has slipped through the net.

 

In the last six or seven weeks we have begun to find a number of our newer computers not pulling across the network policies for the more restricted accounts such as those for the students and teaching staff.

 

As far as I am aware, this has only happened on our newest machines, which not surprisingly have the latest updates and patches. The problem is, no amount of trickery seems to allow these machines to behave as they should once they go wrong. This extends to gpupdate /force, deleting the machine accounts from AD, reimaging and renaming said machines (obviously placing them in their room OU in AD).

 

At present this has only affected a small percentage of our computers but I am fearful that this will become significantly worse. The fact that this also seems to be happening at random makes it difficult to diagnose. I have spoken to a friend of mine who works at a local college that appears to be having a similar problem occuring during the same period of time and coinciding with a mass update of their clients. Of course that could always be a red herring, we have also updated all of our machines but this is only happening to the newest computers at present.

 

As I am sure you can tell, this has caused more than a few headaches with my brain currently in a state of frazzled disrepair.

 

Has anyone experienced the same problem?

[StewartKnight]

are you using static IP's or DHCP?

[badsurname]

Hi there, we're using DHCP addresses for the client machines.

[pooley]

Are the network cards gigabit ?

 

Had this problem and has to disable mediasense to get gpo to apply properly.

 

http://support.microsoft.com/kb/239924/

[badsurname]

On the new machines they are indeed gigabit adapters. I'll give that a try and see what happens. Thank you. That may well match the correlation that I have noticed

[badsurname]

OK, my initial tests have come up with a negative for that idea. I added the new registry key, restarted the computer, applied gpupdate /force, restarted and still found I had the same issue as before. I must admit, this is proving to be more than a little frustrating.

[pooley]

Any errors in Event viewer ?

[timbo343]

Ive had this before.. One or more of your DCs is not replicating correctly. Download something called Ultra sound. Stick it on one of your DCs and this will find out which one is not replicating correctly.

[badsurname]

Ive had this before.. One or more of your DCs is not replicating correctly. Download something called Ultra sound. Stick it on one of your DCs and this will find out which one is not replicating correctly.

Thank you for your help. I have identified a potential problem, but I will have to defer the possible solution until a time when no-one is using the network.

[timbo343]

you can do it when people are using the network, i did. If you have a spare server running that aint a dc, make it a dc, and then de-mote the faulty one.

[badsurname]

The problem is the old Primary Domain Controller, which was turned off without being demoted or decomissioned. I'd feel happier dealing with that at a time when it won't cause trouble. I've gone home for the night, so I'll decomission it in the morning and let you know what happens.

[badsurname]

OK, we have completely removed all traces of the old Global Catalogue server. Ultrasound shows healthy communication between the new GC and DC. Propagation seems to be working well and yet I still cannot force the policy to be pulled across on all the computers.

 

It is causing me to wonder if the fault could lie with the machines themselves. It does only seem to occur at present on the newer machines, which do have gigabit controllers, however the registry entry to stop media sense has not proven to be successful.

 

That said, I am not ruling out the possibility of DC replication issues. I have been informed this morning that computers cannot logon when the secondary domain controller is taken offline. This is despite the fact that the GC is still online and supposedly has responsibility for this function. I haven't tested this personally and I do not know what is causing it, but it does make me think it may be related.

 

I will keep people informed of my findings as I progress and as always, input is greatly appreciated.

[HodgeHi]

I had an issue where the gigabit card (in one machine though) would not get GPO although it had done previously. I had to change it to 10/100mb instead even though it was running on a gigabit switch.

 

I've not used ultrasound before. Does it do the same as replmon?

[badsurname]

I've not used replmon so I wouldn't know I'm afraid. It looks like a more powerful version of it from what I can see though.

 

I have tried switching the ethernet controller to 100MB/s manually, but this has met with no success.

[HodgeHi]

Was the DC that was downed get re-installed or left off-line for a long period of time?

 

Can't recall the length of time it needs to be off-line before the other DCs think it is down for good.

[pooley]

Running gpresult on the offending machines give you any clues ?

[MK-2]

just a long shot, but try this:

create a new OU, different name, and move all the objects from the OU where its not pulling the policy.

either recreate or link the policy you want to enforce and then try the gpupdate/secedit and a few reboots.

 

we had the same problem, thought it was domain replication (it was that also), and in the end i created a new OU, and it all worked.

[timbo343]

You also have to think about the FSMO roles... were any stored on the old server. If so, you have to force the current servers to not to look for them and force a move.

 

We dont seem to have a problem with the gigabit network cards in our machines.

 

You might also want to look at your DNS'

[HodgeHi]

You said you cleared out the OLD GC server. Does this mean you used the NTDSUtil to remove the left-over schema if the dcpromo had not been run before-hand.

 

Replmon will give you who owns each of the FSMO roles.

[badsurname]

OK, to update people so far, though I am still examining a few other possibilities.

 

In order to clear out the old GC Server, we did indeed use NTDSUtil, I have used replmon to examine the FSMO roles and they report to be the current GC server.

 

Despite purging the old GC, when searching for domain controllers its NETBIOS name still shows up. This is proving to be a little curious for me, although it does have to be said that there is no other sign of the machine anywhere else.

 

Running the Group Policy Result tool has initially been unhelpful. At this time at least, the report indicates that all of the policies have been applied successfully. Now it is true that some of the policies have been successful, but certainly not all. I will be looking into this further though, as I am bound to have missed something.

 

Oh and to HodgeHi, no the DC was not down for a long time, but as I am sure you have gathered we have manually purged it from the other computers.

 

Thank you all so much for your help, I will keep you updated as I try some more approaches later on.

[pooley]

How about running the Group Policy modelling wizard and specifying the PC and user($) with the problems ?

[badsurname]

OK, I have now created a new OU for the affected users, unfortunately the problem remains unabated. I'm calling off the problem for a few hours until I can think of something new. This requires some out of the box thinking.

[m25man]

This is a common occurance when DNS pollution happens.

 

Make sure you can ping a suspect machine both forwards and reverse.

(ping and ping -a xxx.xxx.xxx.xxx)

 

Check for dupes in your forward/reverse DNS zones especially reverse if you have been imaging systems.

 

The DNS fails to scavenge correctly or in a timely fashion, multiple hosts appear in DNS to have the same IP when in fact they do not.

Your policies fail to apply because the hostnames are not resolved correctly.

 

If you were capable of orphaning a DC I suspect that a back to basics approach is needed to retrace your steps.

[HodgeHi]

check your firewalls if they are on. I think if you cannot ping the clients then the firewall will most likely be on

[azrael78]

If the XP Firewall was on, you would still get Group Policy through it, we have the XP Firewall disabled via GPO here and we have new PCs, we boot 'em up - log 'em in and viola - no firewall.

 

Things to try:

1) WINS - Clear everything out of your WINS Database - NETBIOS will eventually repopulate this itself.

2) DNS - Can't be stressed enough, fire up DNS and check through the _msdcs.domain container and everything therein. If you didn't manage to remove the old server via DCPROMO, it may still have some footprints in DNS.

3) RSoP - See if an RSoP on an affected machine gives you anything back.

4) Event Viewer - Check this on Server and Client (try to use the same client for all testing, so you have a reference point).

 

I'm guessing when you used NTDSUtil - did you clear out metadata, seize any FSMO roles and such?

 

We had a similar issue when a 'middle' PC was used to upgrade one of our DCs from NT 4 to 2003 - what fun that day was. If only county had known about ADMT.

 

Oh... try running 'netdiag /v' on a DC and 'dcdiag /v' - these are always good things to check.

 

Let us know how it goes.

 

Az