GPO not applying on ramdom computers

[newpersn]

Could this be the start of dns problems?

 

Just looked in to the classroom to see a few computers with the "admin" look desktop.

 

Looked at the envent log and got these.

The processing of Group Policy failed. Windows attempted to read the file \\domainanem\SysVol\nsnet.net\Policies\{3F749B3B-32A0-4D47-8757-79A45B7FD724}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

a) Name Resolution/Network Connectivity to the current domain controller.

b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).

c) The Distributed File System (DFS) client has been disabled.

 

The processing of Group Policy failed. Windows could not obtain the name of a domain controller. This could be caused by a name resolution failure. Verify your Domain Name System (DNS) is configured and working correctly.

 

EventData

 

SupportInfo1 1

SupportInfo2 1903

ProcessingMode 0

ProcessingTimeInMilliseconds 33634

ErrorCode 1355

ErrorDescription The specified domain either does not exist or could not be contacted.

 

The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.

 

EventData

 

SupportInfo1 1

SupportInfo2 2070

ProcessingMode 0

ProcessingTimeInMilliseconds 54944

ErrorCode 8341

ErrorDescription A directory service error has occurred.

DCName \\it-dc.servername

 

Im getting the same error above but with differnent servers.

 

Any help. Its not happening all the time but it effects the users

[Oaktech]

Check your DNS resolution - can the machine resolve everything in the errors manually?

Is our reverse DNS working, does it work for all scopes?

Is it a network issue - anything in any switch logs about links drop/flap?

 

Can you run an RSOP and see what it brings back?

[Michael]

I agree, it does sound like a DNS issue.

[newpersn]

Check your DNS resolution - can the machine resolve everything in the errors manually?

Is our reverse DNS working, does it work for all scopes?

Is it a network issue - anything in any switch logs about links drop/flap?

 

Can you run an RSOP and see what it brings back?

 

RSOP :

 

Just errors out.

 

I can ping servers and get nslookup fine from the computer. As soon as i restart the computer it will behave...

 

I cant ping it on a dc playing up as it doing this on other login servers.

[Michael]

Instead of restarting the server, just reset the DNS Server service on both servers. It takes seconds.

[newpersn]

Instead of restarting the server, just reset the DNS Server service on both servers. It takes seconds.

 

Ive already done this already. It was the first thing me and nm thought of.

[Michael]

Does replication work ok in AD Sites and Services - If you manually perform a replication?

[Oaktech]

RSOP from GP console on the server?

 

Have you got a USB network card you can use?

 

I've seen similar on laptops where the wireless card doesn't kick in until very late in the boot process by which time the window for processing machine policy has gone. Can the machine PXE?

 

Le edit: Can you manually check that both sets of GP repositories are identical on the DCs - or at least present!

Edited January 30, 2015 by Oaktech

[newpersn]

RSOP from GP console on the server?

 

Have you got a USB network card you can use?

 

I've seen similar on laptops where the wireless card doesn't kick in until very late in the boot process by which time the window for processing machine policy has gone. Can the machine PXE?

 

Le edit: Can you manually check that both sets of GP repositories are identical on the DCs - or at least present!

 

This is hit and miss... if the computer gets restarted it works fine. The computer can be on for ages and still not apply GPO.

 

I did RSOP on a computer when a pupil logged on and got this.. (kids dont have access to cmd)

 

[Oaktech]

Errr... OK!

 

Have you recently added a DC? This rather suggests a version mismatch in AD somewhere. This is similar to what happens if you try to bomb a newer dc into AD without running AD prep, or having an AD prep failure while doing it. What are your DCs and what is your functional level?

[newpersn]

Errr... OK!

 

Have you recently added a DC? This rather suggests a version mismatch in AD somewhere. This is similar to what happens if you try to bomb a newer dc into AD without running AD prep, or having an AD prep failure while doing it. What are your DCs and what is your functional level?

 

We haven't added any dcs for over a year now, we got 6 DC servers with 2008R2 and 1 with 2012 (non R2)

 

All servers are running at 2008r2 level.

[Oaktech]

Hmm... Have a read of this and see if this makes any sense for your situation...

https://social.technet.microsoft.com/Forums/windowsserver/en-US/23231586-8b7e-4624-bbdd-a64b2f70cea0/resource-file-has-a-revision-of-90-which-does-not-meet-the-minrequiredrevision-specified-in-the?forum=winserverGP

 

I do wonder if we aren't getting drawn into another issue here.

 

Did you have any luck checking to ensure your AD replication is happening successfully? "repadmin /showrepl" https://social.technet.microsoft.com/Forums/windowsserver/en-US/784d12fd-feb9-4e95-b675-9a4e047bed97/ad-replication-commands

 

can you try a secondary ethernet card in one of these machines just to make sure it's not a hardware issue?

[newpersn]

Did you have any luck checking to ensure your AD replication is happening successfully? "repadmin /showrepl" https://social.technet.microsoft.com/Forums/windowsserver/en-US/784d12fd-feb9-4e95-b675-9a4e047bed97/ad-replication-commands

 

No errors in AD Replication. (by using repadmin /showrepl * /csv > replsd.csv and then looking the file)

 

Hmm... Have a read of this and see if this makes any sense for your situation...

https://social.technet.microsoft.com...um=winserverGP

 

I think its GPO related that its picked up a newer file and its throwing it out...

[newpersn]

Just looked though the logs of 1 of servers.

 

The File Replication Service is unable to add this computer to the following replica set:

"DOMAIN SYSTEM VOLUME (SYSVOL SHARE)"

 

This could be caused by a number of problems such as:

-- an invalid root path,

-- a missing directory,

-- a missing disk volume,

-- a file system on the volume that does not support NTFS 5.0

 

The information below may help to resolve the problem:

Computer DNS name is "DC2012.nsnet.net"

Replica set member name is "DC2012"

Replica set root path is "c:\windows\sysvol\domain"

Replica staging directory path is "c:\windows\sysvol\staging\domain"

Replica working directory path is "c:\windows\ntfrs\jet"

Windows error status code is

FRS error status code is FrsErrorMismatchedJournalId

 

Other event log messages may also help determine the problem. Correct the problem and the service will attempt to restart replication automatically at a later time.

The File Replication Service is in an error state. Files will not replicate to or from one or all of the replica sets on this computer until the following recovery steps are performed:

 

Recovery Steps:

 

[1] The error state may clear itself if you stop and restart the FRS service. This can be done by performing the following in a command window:

 

net stop ntfrs

net start ntfrs

 

If this fails to clear up the problem then proceed as follows.

 

[2] For Active Directory Domain Services Domain Controllers that DO NOT host any DFS alternates or other replica sets with replication enabled:

 

If there is at least one other Domain Controller in this domain then restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and make it non-authoritative.

 

If there are NO other Domain Controllers in this domain then restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and choose the Advanced option which marks the sysvols as primary.

 

If there are other Domain Controllers in this domain but ALL of them have this event log message then restore one of them as primary (data files from primary will replicate everywhere) and the others as non-authoritative.

 

 

[3] For Active Directory Domain Services Domain Controllers that host DFS alternates or other replica sets with replication enabled:

 

(3-a) If the Dfs alternates on this DC do not have any other replication partners then copy the data under that Dfs share to a safe location.

(3-b) If this server is the only Active Directory Domain Services Domain Controller for this domain then, before going to (3-c), make sure this server does not have any inbound or outbound connections to other servers that were formerly Domain Controllers for this domain but are now off the net (and will never be coming back online) or have been fresh installed without being demoted. To delete connections use the Sites and Services snapin and look for

Sites->NAME_OF_SITE->Servers->NAME_OF_SERVER->NTDS Settings->CONNECTIONS.

(3-c) Restore the "system state" of this DC from backup (using ntbackup or other backup-restore utility) and make it non-authoritative.

(3-d) Copy the data from step (3-a) above to the original location after the sysvol share is published.

 

 

[4] For other Windows servers:

 

(4-a) If any of the DFS alternates or other replica sets hosted by this server do not have any other replication partners then copy the data under its share or replica tree root to a safe location.

(4-b) net stop ntfrs

(4-c) rd /s /q c:\windows\ntfrs\jet

(4-d) net start ntfrs

(4-e) Copy the data from step (4-a) above to the original location after the service has initialized (5 minutes is a safe waiting time).

 

Note: If this error message is in the eventlog of all the members of a particular replica set then perform steps (4-a) and (4-e) above on only one of the members.

 

also a few of these in the mix

 

A thread in Active Directory Domain Services is waiting for the completion of a RPC made to the following directory service.

 

Directory service:

34d5f64d-c1c9-4681-97e1-89cbe55816d2._msdcs.nsnet.net

Operation:

get changes

Thread ID:

3c4

Timeout period (minutes):

5

 

Active Directory Domain Services has attempted to cancel the call and recover this thread.

 

User Action

If this condition continues, restart the directory service.

 

Active Directory Domain Services attempted to perform a remote procedure call (RPC) to the following server. The call timed out and was cancelled.

 

Server:

34d5f64d-c1c9-4681-97e1-89cbe55816d2._msdcs.nsnet.net

Call Timeout (Mins):

5

Thread ID:

3c4

 

Additional Data

Internal ID:

500143c

 

Any ideas??

[cullingsh]

We've had this before.

 

Ran the below on the problem server, restarted and let it do its business. Checked in event logs a little later and all was tip-top.

 

 

Run Regedit

Click on Start, Run and type regedit.

Navigate to: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters

Double click on the value name “Enable Journal Wrap Automatic Restore” and update the value to 1.

If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above and set the parameter to 1

[newpersn]

We've had this before.

 

Ran the below on the problem server, restarted and let it do its business. Checked in event logs a little later and all was tip-top.

 

 

Run Regedit

Click on Start, Run and type regedit.

Navigate to: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters

Double click on the value name “Enable Journal Wrap Automatic Restore” and update the value to 1.

If the value name is not present you may add it with the New->DWORD Value function under the Edit Menu item. Type the value name exactly as shown above and set the parameter to 1

 

The problem is that this is happening on most servers...

 

when i do echo %logonserver% on the computers that are not applying it gives me a different server.

[cullingsh]

From the server log you posted earlier, it looks like the server 2012 box. What do your other servers logs say? I would use them to determine which servers are having problems, rather than the clients - I *think* the user logon may be one thing, but the policies could come from somewhere else (or not as the case may be).

 

Shaun

[newpersn]

Would this have anything to do with it?

 

http://www.edugeek.net/forums/windows-server-2008-r2/112115-dc-not-replicating-sysvol.html

 

I just looked at my DC's. I put a folder with its name in the sysvol folder and waited for it to sync.

 

I got 2 servers which are not sync'ed

 

(sorry for the upside down picture of my tests.... I cant delete it to readd

[cullingsh]

So you have two that won't replicate based on that (the same way I determined our issue as well, copy something in and see where it doesn't pop up). I would try the above steps on one of the problem servers and see if it works, then run it on the second. After all, if it isn't working anyway....

[ITGuyWestMidlands]

Do you have any event ids 2213 in the dfs replication log? Did this happen after a dirty shutdown? Edited February 2, 2015 by ITGuyWestMidlands

[newpersn]

I'll have a look for 2213 tomorrow.

 

Yes we had a whole site power loss. Was out for about 2 hours.

[newpersn]

So you have two that won't replicate based on that (the same way I determined our issue as well, copy something in and see where it doesn't pop up). I would try the above steps on one of the problem servers and see if it works, then run it on the second. After all, if it isn't working anyway....

 

Ran it on our 2012 server and it started working fine. About to do the other one tonight. (Takes around 1/2 hour to start up.....)

[ITGuyWestMidlands]

Dfsr stops replicating on a dirty shutdown. You have to resume it manually. Find that error code and it gives you the powershell you need to run

[newpersn]

did my other server and its sorted it self out (once i restarted DHCP & DNS services)

 

Thanks all. (i owe someone a pint)

[newpersn]

 

Dose that mean anything? Seem to have lots of this now....