GPOs over WiFi not applying (Windows 10)

[Tom]

Already verified it can access \\domain\sysvol, as laptop will happily logon a domain user and process it's GPO's, but just won't process them for the station at boot up.

 

my devices are not properly processing the user GPO's every time either. Seems to always fail on the first logon after boot, most of the time on ones after that. flawless everytime when i plug a wire in! (and on other devices). Something wierd is going on as if I try to run the GP RSOP wizard on a machine that has failed GPO's I cant see the user logon to run it against.

 

If I do an RSOP wizard after an on wire bootup and logon everything is there as expected.

[GuyJD]

it could be that your laptops are detecting that they are on a slow link, there is a GP that tells them not to bother loading any domain policies if the link speed drops below 500 kbps

https://technet.microsoft.com/en-us/library/cc978717.aspx

 

You can change the setting in the group policy object to 0 to disable it but I'm guessing you'd have to do that in the local GP editor as you can't push it out from the DC

[Tom]

I have reinstalled a couple of my devices and get them working on a test domain with minimal gpos and got the same issues. I've also installed some different tablets with the same windows 10 image and get the same problems.

 

However, thanks @GuyJD - looks like it is slow link related. It isnt reporting a slow link in event viewer but fully disabling it by GPO (and then restarting them on a wire to get the new settings) seems to make user logon work properly and always apply the GPO's.

 

I cannot however make it apply any of the computer GPO's over wireless. I have forced things like software installation on over a slow link in the same GPO. always just gives GPT.ini errors against the first GPO in the domain and then seems to give up.

 

I think there are slow link detection issues with wireless connections in windows 10...

[themightymrp]

Hi @Tom - could you try something if you get a chance?

 

Launch gpedit.msc from one of the affected Windows 10 machines and browse to:

 

Local Computer Policy --> Computer Configuration --> Administrative Templates --> Network --> Network Provider --> Hardened UNC Paths

 

Set the policy to Enabled, then click the Show button.

 

Enter the following 2 values and set them to equal RequireMutualAuthentication=0, RequireIntegrity=0

\\*\NETLOGON

 

\\*\SYSVOL

 

Close the policy and reboot. See if you are still getting the issues. Also, are these Windows 10 installs completely fresh? As in, installed from the ISO? Or are they custom images? If custom, have you tried a flat install of Win 10 joined to the domain to see if that works?

[Tom]

Hi @Tom - could you try something if you get a chance?

 

Launch gpedit.msc from one of the affected Windows 10 machines and browse to:

 

Local Computer Policy --> Computer Configuration --> Administrative Templates --> Network --> Network Provider --> Hardened UNC Paths

 

Set the policy to Enabled, then click the Show button.

 

Enter the following 2 values and set them to equal RequireMutualAuthentication=0, RequireIntegrity=0

\\*\NETLOGON

 

\\*\SYSVOL

 

Close the policy and reboot. See if you are still getting the issues. Also, are these Windows 10 installs completely fresh? As in, installed from the ISO? Or are they custom images? If custom, have you tried a flat install of Win 10 joined to the domain to see if that works?

 

Nice one @themightymrp! - That appears to fix it! first reboot after setting those and it ran through all the computer policy settings including the software installs!

 

I have just properly read your link which you posted right at the start of this thread. I wish I had read this all earlier! The way that it only seems to be affecting some models and not others had thrown me off.

 

I'm back on site again tomorrow so I can try this live on all the windows 10 devices. It will be interesting to see if the slow link settings are also required or if they just 'mask' the URL hardening issue somehow for user GPO's.

I shall stick the URL hardening settings in via registry from a USB stick, and then reboot some devices and see if they start picking everything up properly on the wireless.

 

I was testing with a flat install of win10 edu x32 today direct from the install.wim on the CD. No windows updates installed. My other image had some more apps in and was updated up to last week.

Edited November 4, 2015 by Tom

[themightymrp]

I hope it works on the rest of the devices! Glad that seems to sort the (yours at least) problem. I'd be intrigued to know if it helps the others on this thread?

 

I'm not really sure of the implications of doing this, going to have a read up about it this morning.

 

Not my code but, if you do deployments via MDT (to create a base image for example), you could add the following lines as custom commands to set this during setup:

 

%COMSPEC% /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths /v "\\*\SYSVOL" /d "RequireMutualAuthentication=0" /t REG_SZ 

%COMSPEC% /C reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkProvider\HardenedPaths /v "\\*\NETLOGON" /d "RequireMutualAuthentication=0" /t REG_SZ

[themightymrp]

Note!!! This above lines need to be added into a Task Sequence BEFORE it joins to the domain!

 

Apparently Microsoft are aware of a bug in this system and are working on an update to rectify it (just read some info dated October 27th). The errors are usually down to a Kerberos authentication error. Not sure exactly how to work out where but this MS article provides some info:

 

Guidance on Deployment of MS15-011 and MS15-014 - Ask Premier Field Engineering (PFE) Platforms - Site Home - TechNet Blogs

 

 

EDIT:

Further tracking information for this error is found in this Event Log:

 

Event Viewer\Applications and Services Logs\Microsoft\Windows\NetworkProvider\Operational

 

Source

Edited November 5, 2015 by themightymrp

[DJ-1701]

Note!!! This above lines need to be added into a Task Sequence BEFORE it joins to the domain!

 

No joy adding them into the task sequence before domain join, still same old issue.

 

EDIT:

Further tracking information for this error is found in this Event Log:

 

Event Viewer\Applications and Services Logs\Microsoft\Windows\NetworkProvider\Operational

 

No items in the log unfortunately .

[Tom]

No joy adding them into the task sequence before domain join, still same old issue.

 

I have had to also disable slow link detection (computer-system-group policy-configure slow link = enabled,0) in addition to setting the hardened UNC path values.

 

I have pushed out the hardened unc values by GPO rather than by script/registry (it is in one of the windows 10 admx files), along with slow link disable. One reboot on the wire makes my wireless clients work again! - So doing it before domain join isn't necessary in my case.

 

They are not logging anything about slow link (and gpresult always says it is not slow!), but setting it seems to be required anyway....

Edited November 5, 2015 by Tom

[Boredguy]

Our GPO's had slow link detection disabled ever since we set the network up, and the log file happily shows that the wifi connection is fast enough.

 

Oh Windows 10, come meet the Angle Grinder.....

[DJ-1701]

Any other ideas? This is just baffling.

[Armand]

Can confirm that those two registry keys worked for me, in addition to having all the slow link detection etc disabled.

Thanks a bunch, been stuck on this one for a while!!

[Boredguy]

Can confirm that those two registry keys worked for me, in addition to having all the slow link detection etc disabled.

Thanks a bunch, been stuck on this one for a while!!

 

Are you using Enterprise or Educational build of Windows 10?

[Armand]

Are you using Enterprise or Educational build of Windows 10?

 

Enterprise - the one released recently.

 

Will be trying same settings on EDU also when I get some time

[Michael]

The issue is described exactly here for all previous Operating Systems (up to Windows 8.1). In Windows 7 and 8.1 UNC hardening is disabled, but in Windows 10 it's enabled by default.

 

Until Microsoft release a fix, the only solution is to use the UNC Hardening GPO and specify the following as already described above:

 

Name         Value
\\*\NETLOGON RequireMutualAuthentication=0, RequireIntegrity=0
\\*\SYSVOL RequireMutualAuthentication=0, RequireIntegrity=0

 

The only issue of course, is if your workstation doesn't process ANY computer based GPO, then the above won't work either without manual intervention.

 

Interestingly (as far as I can tell) computer based GPOs are applying, but MSIs are not deploying over a WiFi connection.

 

You can also create a GPP regedit, which is considerably quicker, seeing as you can easily copy/paste GPP regedits.

 

[Armand]

Enterprise - the one released recently.

 

Will be trying same settings on EDU also when I get some time

 

So I can confirm this fix works on versions PRO EDU ENT.

Just a GPO with the updated registry fixes takes care of it.

 

Painful to get to this point as I came across another post in spiceworks describing the same issue and resolved with a driver update from INTEL - so I went the same route and got driver updates etc etc..

 

Very interesting that this one is not fixed by Microsoft - I would imagine it's a pretty big issue for schools/enterprise!!

[DJ-1701]

Thanks both, valuable information for anyone having this issue to know.

 

Just annoying that that seems to be the answer for everyone else, but not for @Boredguy and me. The driver was the first thing I tried, but from the limited driver versions available for the adapters, none of them made any difference.

If I have time, I'll give the laptops a kick again tomorrow and see what happens... unless @Boredguy has created Frankenstein's monster with them while I have been off site.

Edited December 16, 2015 by DJ-1701

[mattpayne]

Just to confirm, looks like its working here too - Microsoft Surface 3 tablets, upgraded from OEM win8.1 to win10 pro retail x64.

all worked fine on the wired LAN, but wifi refused to install gpo software assignments.

 

created a new GPO with the slow link detection and enabled the UNC hardening win10 ADMX template with requiteauthentication and integrity for sysvol & netlogon =0

 

all is now good in the world!

 

Thanks guys! have a great Christmas!

[Michael]

In addition to what I wrote above, if you create a good old fashioned logon script and specify the following, it pulls down the changed GPO or GPP, whichever method you used:

 

@echo off
gpupdate /force /wait:0

 

Just specify the logon script for all AD users which you can easily achieve in bulk.

[Michael]

Another alternative which works is to place the file within Startup (Folder Redirection), for example:

 

Pupils > Start Menu > Programs > Startup. Optionally you can right click the Startup folder and make it hidden.

[abaxter2]

I know I am late to this thread but thought I would just share that I have found that access points that are connected to spanning tree enabled switches have problems with the UNC hardening feature but access points connected to dummy switches (unmanaged) do not have any problems - So I disabled spanning tree on my managed switches and have had no problems with the UNC hardening feature and do not need to add any registry keys or configure the UNC hardening GPO - I have also enabled 'Disable detection of slow network connections' and enabled 'Always wait for the network at computer startup and logon' and also on my GPO that applies to my Wi-Fi I also enabled 'configure Group Policy slow link detection' set to: 0. With these setting in place I have found that my GPO's apply to lan and wireless clients without a problem.

[grcmptrnrd]

I was having this trouble with a new Dell laptop running Windows 7. The solution turned out to be disabling the Dell radio control device (name not 100% correct). This loses the ability to use a quick FN-Radio key to turn off all radio devices, but GPOs seem to work OK.

[kcalderw]

Just to confirm, looks like its working here too - Microsoft Surface 3 tablets, upgraded from OEM win8.1 to win10 pro retail x64.

all worked fine on the wired LAN, but wifi refused to install gpo software assignments.

 

created a new GPO with the slow link detection and enabled the UNC hardening win10 ADMX template with requiteauthentication and integrity for sysvol & netlogon =0

 

all is now good in the world!

 

Thanks guys! have a great Christmas!

 

I'm trying this on the same setup. I have Surface 3s on Windows 10 Pro 1703. I have a GPO set for the Start Menu Layout but it is not applying on wifi. It always applies if I plugin a USB-Ethernet adapter and hardwire it. I did not have hardened UNC paths set but I do now, no change.

[gshaw]

Bit of a thread necro but are people still applying these keys on imaging?

 

Had a Win10 1703 laptop come back the other day exhibiting the same GPO failures and unable to connect to NETLOGON. Applied the keys via GPP and manual gpupdate over a LAN connection and all started working OK again.

 

Just about to drop them into MDT but thought I'd check as ideally it seems you'd want the security settings on if they weren't bugged.

[GuyJD]

I only have the slow link detection and hardened paths set and my new build laptops pick up GPs fine over wifi without needing to connect wired first.