Win 10 Machines not picking up new GPOs until second reboot

[CommodoreS]

On the new network I am working on something very strange is happening.

 

If I do not turn a machine on for a day or so when I first turn it on it goes straight to the windows logon screen and new GPOs do not get applied. If I then immediately do a reboot upon reboot the new GPOs are getting applied.

 

This is happening to both wired PCs and wireless laptops.

 

Machines are on a very long DHCP lease so are keeping their IP and DNS settings.

 

I am wondering if there is still a rogue GPO setting from Windows 7 somewhere in the AD causing this.

 

If anyone had any ideas what may cause this, please let me know.

[CommodoreS]

I am still having this issue. Does anyone have any ideas?

 

I am wondering still if is a GPO setting like:

Run startup scripts asynchronously Enabled

 

Which worked fine on Windows 7 and wondering if its something like that causing issues with new GPOs applying on the first boot. Always get applied fine if doing an immediate restart.

[snagrat]

Have you sent the GPO Processing time? And the wait for network at logon?

[CommodoreS]

Always wait for the computer at startup and logon = Enabled

 

Registry item SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon GpNetworkStartTimeoutPolicy set to 60

[snagrat]

Not sure why you are doing that one via registry but via GPO I set mine to 120

[sparkeh]

Anything in the event logs about not being able to contact a domain controller?

 

I have a similar issue with some of our machines with SSDs booting too quickly so the NIC isn't initiliased in time. This means that it can't contact a DC so skips group policy processing. Once it contacts a DC it gets the policy.

[CommodoreS]

Not sure why you are doing that one via registry but via GPO I set mine to 120

 

Also not sure why I am doing that one via registry, but expect there was a reason.

 

What is the GPO setting for this setting called and where is it located?

[CommodoreS]

Anything in the event logs about not being able to contact a domain controller?

 

I have a similar issue with some of our machines with SSDs booting too quickly so the NIC isn't initiliased in time. This means that it can't contact a DC so skips group policy processing. Once it contacts a DC it gets the policy.

 

I will check, but it sounds like this could be the same thing happening.

 

What did you do to resolve the issue please?

[ricki]

Always wait for the computer at startup and logon = Enabled

 

Registry item SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon GpNetworkStartTimeoutPolicy set to 60

I agree with this method but have mine set to 100. I do it manually by registry because it will not apply by GPO as machine boots too quickly Richard

I am still having this issue. Does anyone have any ideas?

 

I am wondering still if is a GPO setting like:

Run startup scripts asynchronously Enabled

 

Which worked fine on Windows 7 and wondering if its something like that causing issues with new GPOs applying on the first boot. Always get applied fine if doing an immediate restart.

[CommodoreS]

I will try increasing it to 120 and see what happens. I am still interested to hear how sparkeh solved their NIC problem.

[CommodoreS]

This could be why I set it to 60 seconds: https://support.microsoft.com/en-us/help/2421599/windows-7-clients-intermittently-fail-to-apply-group-policy-at-startup

 

It also told me the GPO is in Computer Configuration > Policies > Admin Templates > System > Group Policy which was also enabled to 60 seconds. I guess it cant hurt to have both the GPO and a registry setting applied. I have now set both to 120.

 

The only other GPO I have set inside Computer Configuration > Policies > Admin Templates > System > Group Policy is Configure Registry Policy Processing which is enabled for Process even if the group policy objects have not changed and disabled for Do not apply during periodic background processing.

 

I am wondering if I should also try enabling Set group policy refresh interval for computers to a low value and see what heppens.

 

The event viewer logs showing no issues or problems. Strangely it said some GPOs had applied, but new MSI software I had allocated still did not start installing until after restarting the computer after the first boot and also did not pick up a change I made to remove sleep from power options.

 

I will also try adding the DNS record as explained here: https://community.spiceworks.com/topic/291388-windows-doesn-t-recognize-domain-until-60-seconds-after-startup

[sparkeh]

I will try increasing it to 120 and see what happens. I am still interested to hear how sparkeh solved their NIC problem.

 

Sorry, I haven't, it's ongoing :s