HELP! Very odd issues in group policy management

[edutech4schools]

Just went to make a change to our GPO WSUS policy and the path to the policy is not displayed.

 

If I click on our WSUS policy it lists in the right window, computer config/policies/admin templates/extra registry settings. Which does not sound right to me.

If I try to edit the policy and browse the path I get, computer config/admin templates but all the normal items from that point on are missing, I only have 'Google' and 'all settings' listed.

 

in the right windows under admin templates it says ' Policy definitions (ADMX files) retrieved from the central store.'

 

in the right window under all settings it says 'Display names for some settings cannot be found. You might be able to resolve this issue by updating the .ADM files used by Group Policy Management.

 

Really hope someone can help me fix this.

[Joanne]

Please can you post a screen shot?

[edutech4schools]

As you can see I seem to be missing some items under 'Admin Templates'

 

[edutech4schools]

As you can see I seem to be missing some items under 'Admin Templates' like 'Windows components'

 

[ATTACH=CONFIG]35308[/ATTACH]

Edited February 29, 2016 by edutech4schools

[Sagima]

I would have thought you could just copy the group policy templates back into your central store (it looks like someone has deleted a few or that they became corrupt)

 

The installer for the 2012r2/8.1 ones is here https://www.microsoft.com/en-gb/download/details.aspx?id=43413

 

You could probably sue the windows 10 ones if you wanted - just copy them over what you already have.

[edutech4schools]

So am I OK using the 2012r2 ones on a 2008r2 server???

[pantscat]

You'll only be able to use the specific 2012R2 settings from a 2012R2 server or a Win8.1 client.

 

The 2008R2/Win7 templates are here: Download Administrative Templates (ADMX) for Windows Server 2008 R2 and Windows 7 from Official Microsoft Download Center

[edutech4schools]

Thanks.

 

Just before I run this is there anything I should be aware of? Can I run this while staff are logged in? will I need to reboot the server? etc.

[pantscat]

No - it just unpacks the files to a folder - it's fine.

[Sagima]

It should unpack the definitions into your program files directory - just copy the policydefinitions folder to\\DOMAIN\SYSVOL\DOMAIN\Policies\

 

If it prompts for any overwrites just let it go on with it. If you still get group policy errors after that you may need to go and copy the chrome, office 2010/2013 (or anything else but they are the ones I use) ones into the same policydefinitions folder as well (if you use those and manage them via group policy)

[edutech4schools]

would that be \\DOMAIN\SYSVOL\DOMAIN\Policies\PolicyDefinitions ??? or not?

 

The PolicyDefinitions folder seems to contain similar looking files

 

EDIT Ignore that, just re-read your post

Edited March 1, 2016 by edutech4schools

[Sagima]

When I last did it the admx installer created a folder called policydefinitions that I copied to that location but if you want to copy the contents of policydefinitions into the policydefinitions folder you already have that will work just as well.

 

That folder is where all of the group policies live

[edutech4schools]

That is fantastic, I can't thank you all enough.

 

I have just noticed an error on our other DC in regards to Group policy. All the policy definitions seem to have copied to server from the main server (or never got deleted in the first place) and AD seems to be working but when I try to open Group Policy management I get the following.

 

[ATTACH=CONFIG]35317[/ATTACH]

[Sagima]

I get invalid attachment with that

[Joanne]

Same. If the servers are on the same domain then the policies should sync (I think?) across the servers.

[Sagima]

The SYSVOL (and the NETLOGON) folder is automatically replicated with all of the other domain controllers. If replication is failing then that is something to have a look at quite urgently

Really need to see the error message

[edutech4schools]

 

Thanks again for the help

[edutech4schools]

AD is replicating fine. Just created a user and it replicated to the other server.

[edutech4schools]

Also, if I create a file in Netlogon it is replicated. Just not sure why I am getting the error in the pic a few posts up.

[Joanne]

Are both servers in DNS entries?

[edutech4schools]

Yes DNS looks good to me. Both are listed as GC in DNS with correst IP's

[Joanne]

Might have just been that one time it couldn't find it if you rebooted or whatever.... ?

[edutech4schools]

OK going to reboot

[edutech4schools]

Still the same. Just looking in the logs and have the following on the 'Other' server

 

Active Directory Domain Services could not use DNS to resolve the IP address of the source domain controller listed below. To maintain the consistency of Security groups, group policy, users and computers and their passwords, Active Directory Domain Services successfully replicated using the NetBIOS or fully qualified computer name of the source domain controller.

Invalid DNS configuration may be affecting other essential operations on member computers, domain controllers or application servers in this Active Directory Domain Services forest, including logon authentication or access to network resources.

[Joanne]

Check you have reverse lookup configured correctly...

 

https://technet.microsoft.com/en-us/library/cc961414.aspx

 

eg/ if your ip range is 10.20.30.* then the reverse lookup will be 30.20.10.in.addr.arpa

 

Check that error log out a bit more and see if there is a link to a technet article, it might shed a little more light on it. I'm not massively up on my DNS but I'm sure someone else will be along shortly to help!