Group Policy during Logon

[DigiBen]

Has anyone else had this issue with Group Policy not loading during logon?

 

So I switch a laptop on (Running Windows 10 Enterprise LTSB), login, and get a blank profile. No redirected desktop, no shortcuts, no drives etc etc.

Log off, log back on again as the same user, and everything is fine. Desktop, start menu, mapped drives, the lot are all there.

 

So I reboot, wait 30 seconds, login. Nothing.

 

Reboot. wait about 2 minutes, login, everything is there.

 

A quick google suggested UNC Hardened paths. So I added those in as suggested, but it made no difference at all

 

Any suggestions would be appreciated

[dapaulio]

Can you ping all of your dc's

 

Also check the dc's replication health using sysadmin /replsummary

Edited January 29, 2016 by dapaulio

[Jawloms]

If you type echo %LOGONSERVER% at a command prompt it will tell you which DC auth'd you. Might notice a pattern?

[DigiBen]

On a bit of a whim, I have taken the laptops off the domain, and put them back on again after seeing an error about UAC.

 

Both are working fine now, so I just need to do this to the other 30 laptops...

 

My best guess is that either it was UAC related, or the UNC hardening fix didnt apply till a domain reseat. Previously I had UAC disabled, but I have since made it so the Win10 clients dont get this policy anymore, but it may have needed a reseat for this to work?

[Michael]

After you've configured hardened paths, you need to run gpupdate /force on the device, then reboot.

[DigiBen]

Yes obviously I did a gpupdate /force, and many many reboots. But that didnt work, the domain reseat did though

[Michael]

Yes obviously I did a gpupdate /force, and many many reboots. But that didnt work, the domain reseat did though

 

Sorry - I suggested it as you hadn't mentioned it. In my experience, I have no issue with Windows 10 clients processing GPOs - it was more so the fact that MSIs wouldn't deploy, but the hardened UNC paths for Netlogon and Sysvol did the trick. This is all on Win 10 Edu, however the LTSB version should (logically), behave the same.

 

Have you looked at the event logs? I can't think of anything else right now.

[Javik]

Group policy can be slow to apply, due to something that Microsoft calls the Fast Logon Optimization. It does a background refresh of GPO that delays things that may be very important to your profile configurations.

 

I do not know how this is actually useful for anything, by not applying GPO settings immediately. Generally I disable the Fast Logon Optimization on all desktops/laptops so it stops breaking things.

 

Also I disable slow link detection, as that just means the stale local cached profile (if one exists) will be used, rather than waiting to download the stored roaming profile which is actually the most current version. I do not understand how it is useful to use the cached / stale profile that isn't current. Another "WTF Microsoft" moment.

 

Computer Configuration

- - Administrative Templates

- - - - System

- - - - - - Logon

- - - - - - - - Always wait for the network - Enabled

- - - - - - User Profiles

- - - - - - - - Do not detect slow connections - Enabled

 

More info:

https://technet.microsoft.com/en-us/magazine/gg486839.aspx

Edited March 2, 2016 by Javik