newpersn Posted January 30, 2015 Posted January 30, 2015 Could this be the start of dns problems? Just looked in to the classroom to see a few computers with the "admin" look desktop. Looked at the envent log and got these. The processing of Group Policy failed. Windows attempted to read the file \\domainanem\SysVol\nsnet.net\Policies\{3F749B3B-32A0-4D47-8757-79A45B7FD724}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: a) Name Resolution/Network Connectivity to the current domain controller. b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). c) The Distributed File System (DFS) client has been disabled. The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctly. EventData SupportInfo1 1 SupportInfo2 1903 ProcessingMode 0 ProcessingTimeInMilliseconds 33634 ErrorCode 1355 ErrorDescription The specified domain either does not exist or could not be contacted. The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful. EventData SupportInfo1 1 SupportInfo2 2070 ProcessingMode 0 ProcessingTimeInMilliseconds 54944 ErrorCode 8341 ErrorDescription A directory service error has occurred. DCName \\it-dc.servername Im getting the same error above but with differnent servers. Any help. Its not happening all the time but it effects the users
Oaktech Posted January 30, 2015 Posted January 30, 2015 Check your DNS resolution - can the machine resolve everything in the errors manually? Is our reverse DNS working, does it work for all scopes? Is it a network issue - anything in any switch logs about links drop/flap? Can you run an RSOP and see what it brings back? 1
newpersn Posted January 30, 2015 Author Posted January 30, 2015 Check your DNS resolution - can the machine resolve everything in the errors manually? Is our reverse DNS working, does it work for all scopes? Is it a network issue - anything in any switch logs about links drop/flap? Can you run an RSOP and see what it brings back? RSOP : Just errors out. I can ping servers and get nslookup fine from the computer. As soon as i restart the computer it will behave... I cant ping it on a dc playing up as it doing this on other login servers.
Michael Posted January 30, 2015 Posted January 30, 2015 Instead of restarting the server, just reset the DNS Server service on both servers. It takes seconds.
newpersn Posted January 30, 2015 Author Posted January 30, 2015 Instead of restarting the server, just reset the DNS Server service on both servers. It takes seconds. Ive already done this already. It was the first thing me and nm thought of.
Michael Posted January 30, 2015 Posted January 30, 2015 Does replication work ok in AD Sites and Services - If you manually perform a replication?
Oaktech Posted January 30, 2015 Posted January 30, 2015 (edited) RSOP from GP console on the server? Have you got a USB network card you can use? I've seen similar on laptops where the wireless card doesn't kick in until very late in the boot process by which time the window for processing machine policy has gone. Can the machine PXE? Le edit: Can you manually check that both sets of GP repositories are identical on the DCs - or at least present! Edited January 30, 2015 by Oaktech
newpersn Posted January 30, 2015 Author Posted January 30, 2015 RSOP from GP console on the server? Have you got a USB network card you can use? I've seen similar on laptops where the wireless card doesn't kick in until very late in the boot process by which time the window for processing machine policy has gone. Can the machine PXE? Le edit: Can you manually check that both sets of GP repositories are identical on the DCs - or at least present! This is hit and miss... if the computer gets restarted it works fine. The computer can be on for ages and still not apply GPO. I did RSOP on a computer when a pupil logged on and got this.. (kids dont have access to cmd)
Oaktech Posted January 30, 2015 Posted January 30, 2015 Errr... OK! Have you recently added a DC? This rather suggests a version mismatch in AD somewhere. This is similar to what happens if you try to bomb a newer dc into AD without running AD prep, or having an AD prep failure while doing it. What are your DCs and what is your functional level?
newpersn Posted January 30, 2015 Author Posted January 30, 2015 Errr... OK! Have you recently added a DC? This rather suggests a version mismatch in AD somewhere. This is similar to what happens if you try to bomb a newer dc into AD without running AD prep, or having an AD prep failure while doing it. What are your DCs and what is your functional level? We haven't added any dcs for over a year now, we got 6 DC servers with 2008R2 and 1 with 2012 (non R2) All servers are running at 2008r2 level.
Oaktech Posted January 30, 2015 Posted January 30, 2015 Hmm... Have a read of this and see if this makes any sense for your situation... https://social.technet.microsoft.com/Forums/windowsserver/en-US/23231586-8b7e-4624-bbdd-a64b2f70cea0/resource-file-has-a-revision-of-90-which-does-not-meet-the-minrequiredrevision-specified-in-the?forum=winserverGP I do wonder if we aren't getting drawn into another issue here. Did you have any luck checking to ensure your AD replication is happening successfully? "repadmin /showrepl" https://social.technet.microsoft.com/Forums/windowsserver/en-US/784d12fd-feb9-4e95-b675-9a4e047bed97/ad-replication-commands can you try a secondary ethernet card in one of these machines just to make sure it's not a hardware issue?
newpersn Posted January 30, 2015 Author Posted January 30, 2015 Did you have any luck checking to ensure your AD replication is happening successfully? "repadmin /showrepl" https://social.technet.microsoft.com/Forums/windowsserver/en-US/784d12fd-feb9-4e95-b675-9a4e047bed97/ad-replication-commands No errors in AD Replication. (by using repadmin /showrepl * /csv > replsd.csv and then looking the file) Hmm... Have a read of this and see if this makes any sense for your situation... https://social.technet.microsoft.com...um=winserverGP I think its GPO related that its picked up a newer file and its throwing it out...
newpersn Posted February 2, 2015 Author Posted February 2, 2015 Just looked though the logs of 1 of servers. The File Replication Service is unable to add this computer to the following replica set: "DOMAIN SYSTEM VOLUME (SYSVOL SHARE)" This could be caused by a number of problems such as: -- an invalid root path, -- a missing directory, -- a missing disk volume, -- a file system on the volume that does not support NTFS 5.0 The information below may help to resolve the problem: Computer DNS name is "DC2012.nsnet.net" Replica set member name is "DC2012" Replica set root path is "c:\windows\sysvol\domain" Replica staging directory path is "c:\windows\sysvol\staging\domain" Replica working directory path is "c:\windows\ntfrs\jet" Windows error status code is FRS error status code is FrsErrorMismatchedJournalId Other event log messages may also help determine the problem. Correct the problem and the service will attempt to restart replication automatically at a later time. The File Replication Service is in an error state. Files will not replicate to or from one or all of the replica sets on this computer until the following recovery steps are performed: Recovery Steps: [1] The error state may clear itself if you stop and restart the FRS service. This can be done by performing the following in a command window: net stop ntfrs net start ntfrs If this fails to clear up the problem then proceed as follows. [2] For Active Directory Domain Services Domain Controllers that DO NOT host any DFS alternates or other replica sets with replication enabled: If there is at least one other Domain Controller in this domain then restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and make it non-authoritative. If there are NO other Domain Controllers in this domain then restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and choose the Advanced option which marks the sysvols as primary. If there are other Domain Controllers in this domain but ALL of them have this event log message then restore one of them as primary (data files from primary will replicate everywhere) and the others as non-authoritative. [3] For Active Directory Domain Services Domain Controllers that host DFS alternates or other replica sets with replication enabled: (3-a) If the Dfs alternates on this DC do not have any other replication partners then copy the data under that Dfs share to a safe location. (3-b) If this server is the only Active Directory Domain Services Domain Controller for this domain then, before going to (3-c), make sure this server does not have any inbound or outbound connections to other servers that were formerly Domain Controllers for this domain but are now off the net (and will never be coming back online) or have been fresh installed without being demoted. To delete connections use the Sites and Services snapin and look for Sites->NAME_OF_SITE->Servers->NAME_OF_SERVER->NTDS Settings->CONNECTIONS. (3-c) Restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and make it non-authoritative. (3-d) Copy the data from step (3-a) above to the original location after the sysvol share is published. [4] For other Windows servers: (4-a) If any of the DFS alternates or other replica sets hosted by this server do not have any other replication partners then copy the data under its share or replica tree root to a safe location. (4-b) net stop ntfrs (4-c) rd /s /q c:\windows\ntfrs\jet (4-d) net start ntfrs (4-e) Copy the data from step (4-a) above to the original location after the service has initialized (5 minutes is a safe waiting time). Note: If this error message is in the eventlog of all the members of a particular replica set then perform steps (4-a) and (4-e) above on only one of the members. also a few of these in the mix A thread in Active Directory Domain Services is waiting for the completion of a RPC made to the following directory service. Directory service: 34d5f64d-c1c9-4681-97e1-89cbe55816d2._msdcs.nsnet.net Operation: get changes Thread ID: 3c4 Timeout period (minutes): 5 Active Directory Domain Services has attempted to cancel the call and recover this thread. User Action If this condition continues, restart the directory service. Active Directory Domain Services attempted to perform a remote procedure call (RPC) to the following server. The call timed out and was cancelled. Server: 34d5f64d-c1c9-4681-97e1-89cbe55816d2._msdcs.nsnet.net Call Timeout (Mins): 5 Thread ID: 3c4 Additional Data Internal ID: 500143c Any ideas??
cullingsh Posted February 2, 2015 Posted February 2, 2015 We've had this before. Ran the below on the problem server, restarted and let it do its business. Checked in event logs a little later and all was tip-top. Run Regedit Click on Start, Run and type regedit. Navigate to: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters Double click on the value name “Enable Journal Wrap Automatic Restore” and update the value to 1. If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above and set the parameter to 1 2
newpersn Posted February 2, 2015 Author Posted February 2, 2015 We've had this before. Ran the below on the problem server, restarted and let it do its business. Checked in event logs a little later and all was tip-top. Run Regedit Click on Start, Run and type regedit. Navigate to: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters Double click on the value name “Enable Journal Wrap Automatic Restore” and update the value to 1. If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above and set the parameter to 1 The problem is that this is happening on most servers... when i do echo %logonserver% on the computers that are not applying it gives me a different server.
cullingsh Posted February 2, 2015 Posted February 2, 2015 From the server log you posted earlier, it looks like the server 2012 box. What do your other servers logs say? I would use them to determine which servers are having problems, rather than the clients - I *think* the user logon may be one thing, but the policies could come from somewhere else (or not as the case may be). Shaun
newpersn Posted February 2, 2015 Author Posted February 2, 2015 Would this have anything to do with it? http://www.edugeek.net/forums/windows-server-2008-r2/112115-dc-not-replicating-sysvol.html I just looked at my DC's. I put a folder with its name in the sysvol folder and waited for it to sync. I got 2 servers which are not sync'ed (sorry for the upside down picture of my tests.... I cant delete it to readd
cullingsh Posted February 2, 2015 Posted February 2, 2015 So you have two that won't replicate based on that (the same way I determined our issue as well, copy something in and see where it doesn't pop up). I would try the above steps on one of the problem servers and see if it works, then run it on the second. After all, if it isn't working anyway....
ITGuyWestMidlands Posted February 2, 2015 Posted February 2, 2015 (edited) Do you have any event ids 2213 in the dfs replication log? Did this happen after a dirty shutdown? Edited February 2, 2015 by ITGuyWestMidlands
newpersn Posted February 2, 2015 Author Posted February 2, 2015 I'll have a look for 2213 tomorrow. Yes we had a whole site power loss. Was out for about 2 hours.
newpersn Posted February 2, 2015 Author Posted February 2, 2015 So you have two that won't replicate based on that (the same way I determined our issue as well, copy something in and see where it doesn't pop up). I would try the above steps on one of the problem servers and see if it works, then run it on the second. After all, if it isn't working anyway.... Ran it on our 2012 server and it started working fine. About to do the other one tonight. (Takes around 1/2 hour to start up.....)
ITGuyWestMidlands Posted February 2, 2015 Posted February 2, 2015 Dfsr stops replicating on a dirty shutdown. You have to resume it manually. Find that error code and it gives you the powershell you need to run 1
newpersn Posted February 2, 2015 Author Posted February 2, 2015 did my other server and its sorted it self out (once i restarted DHCP & DNS services) Thanks all. (i owe someone a pint)
newpersn Posted February 3, 2015 Author Posted February 3, 2015 Dose that mean anything? Seem to have lots of this now....
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now