Clients not picking up GPOs

[nimrodel]

Hi,

Can anyone help with the following problem please?

 

I created a GPO for all teachers and another one for all pupils. The policy (amongst other things) redirected the user's folders. I have now created a new shared folder on the Server as I wish to store the users' documents in a different place.

I created a folder called "PupilFolder" for the pupils and "StaffFolder" for the teachers. I researched the correct permissions for these folders as I know that getting this wrong can cause problems, so I'm fairly confident that the permissions are fine.

I amended the 'PUPI'L GPO to redirect the folders to the new location. I then logged on to a pupil account and watched as the folder for that account was created and all the documents were automatically moved across. I did the same for several accounts and all performed perfectly.

I did the same for the 'TEACHER' GPO but did not have the teacher passwords so didn't try testing the accounts. The next day I checked the folder expecting to see a folder for each teacher but there were only about 5 folders (should be around 20). When I investigated, all staff were either not picking up the GPO at all or were still being redirected to the old folder (how can this happen?). When I tried to log on to a pupil account, this no longer worked and again the GPO was ignored or the old folder was being used.

I also have a separate GPO for each class that puts a different picture on the desktop. This is not being picked up either. Looking at the system log, I get:

"The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one or more of the following:

a) Name Resolution failure on the current domain controller

b) Active Direction Replication Latency (an account created on another domain controller has not replicated to the current domain controller)."

 

As I only have one Server (running 2016) it rules out option (b) but I don't understand how to fix the error (a).

 

Sorry i've waffled...thanks for reading. Any help gratefully accepted.

 

Dave

[LeMarchand]

Have you set up scavenging on your DNS server? Wondering if (a) is being caused by a load of duff records there.

 

Is your single server physical or virtual? If the latter, I'm surprised that you don't have a secondary DC.

 

Staff not picking up GPOs: if they're anything like most of mine, they never turn off/restart their machines. Have you tried running gpupdate /force on one of the ones not getting redirected?

[dapaulio]

Let’s start with the basics.

Can you ping the dc and the file share server from the computers not applying the group policy?

Can the dc and the file share server ping each other?

What do the event logs on your server with the new file share have to offer?.

[nimrodel]

Server can be pinged by name from client

Only one server so DC & File server the same.

The only error on the server event logs is:

The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID

{8D8F4F83-3594-4F07-8369-FC3C3CAE4919}

and APPID

{F72671A9-012C-4725-9D2F-2A4D32D65169}

to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.

[nimrodel]

Don't think scavenging is turned on (not really sure to be honest).

Server is physical. Only one server because only small school and it's difficult enough getting money for a pencil ;-)

Already tried gpupdate but have also removed apc from teh domain and rejoined and that didn't make any difference. However, gpupdate does nothing but event log reports that both computer and user GPOs completed successfully. But they haven't.

[Achandler]

do gpresult /r

 

It will show you all the policies applying, then atleast you can see if the problem is the policy isn't even being seen or that the policy does apply but sin't doing what you expect.

[nimrodel]

gpresult /r is interesting:

 

Last time group policy was applied: 13/11/2017 10:50:20 (this is when I did gpupdate)

Group policy was applied from: (gives correct server name)

Domain name: (gives correct domain)

 

Applied Group Policy Objects:

Default Domain Policy

Printers

 

(Neither of my GPOs are being applied!!)

 

The rest seems fine.

 

So this implied that my GPOs don't exist!!!

 

I have checked them and they have been moved into the domain location and they have a group in then security listing called 'PUPILS' of which the user I am logging in with is a member. I have also run GP modelling and this indicates that the GPs should apply.

 

What else can stop it from applying yet not show up in gpresult nor the logs??

[sted]

either they are failing to be applied or for some reason they are filtered so dont apply eg wmi filters being in a gpo that dosent get the policy. is that logged on as you or the user that has problems? if you run rsop.msc it shows you policies that arnt applied as well and to some degree why though you may have to convert the sid to the name if it diddnt apply. so for mine some say denied wmi filter a lot say denied unknown reason but the one i checked was basically this pc isnt a member of group x so dosent need this printer policy etc adn the rest will be similar

[nimrodel]

Hmmm...RSOP.MSC (run on the client) brings up an error:

Unable to generate RSoP data. In logging mode, likely causes are Group Policy has never successfully processed for this computer or user., RSoP logging was never enabled, or data is corrupt. In planning mode, verify that the selected domain controller supports RSoP.

Details: Invalid namespace

[sted]

its possible group policys are blocking users running it its probably worth testing as an admin

[nimrodel]

RSOP when logged in as administrator just shows a basic list of applied policies, but none from my GPOs. But why would it if I'm logged in as administrator? These policies are only applying to certain users, not to admins.

[sted]

RSOP when logged in as administrator just shows a basic list of applied policies, but none from my GPOs. But why would it if I'm logged in as administrator? These policies are only applying to certain users, not to admins.

 

it proves rsop isnt borked which can happen. if you cant run it as a user i suspect you have a policy blocking them from running it

[nimrodel]

OK guys, I think I've solved the problem!!

Although the answer is weird...I have come across an old article (June 2016) warning of a MS update that breaks GPOs. The symptoms were exactly the same as the ones I was experiencing. IF that update was applied to my server last week (why that should be the case is a mystery!) it would explain why policies that were previously working suddenly stopped working.

The update (I guess you all know about this) meant that you needed 'authenticated users' group and/or 'domain computers' group in the "delegation" of the GPO. I wasn't aware of that and the affected GPOs didn't have this.

I have now added the delegations and (apart from few problems with folder redirection) it SEEMS to be working.

 

Thanks all for your help and suggestions, and thanks MS for yet again bringing out an update unannounced that breaks things!!! ;-)

[kjadams]

Nimrodel, can you tell us which update caused the problem as we are having similar problems.

[psydii]

https://blogs.technet.microsoft.com/askpfeplat/2016/07/05/who-broke-my-user-gpos/

https://blogs.technet.microsoft.com/askds/2016/06/22/deploying-group-policy-security-update-ms16-072-kb3163622/

https://sdmsoftware.com/group-policy-blog/bugs/new-group-policy-patch-ms16-072-breaks-gp-processing-behavior/

 

After this update the gpclient on the machines runs as the LocalSystem account to read the policies from the DCs. Previously it would be read by gpclient in the context of the logged on user. This means if you have a GPO where the Computer Account of the computer that is being used does not have access, the policy cannot be read, and therefor cannot be applied.

[nimrodel]

Yep, that's the one. The only thing I can't understand is why it was only applied to my server very recently as it was released in June 2016.

I added "domain computers" group to the "delegation" of all my GPOs and they immediately started working!

[buzzard]

it may have been rolled up in to one of the new CU patches, nt sure thats just a guess. I know we needed to adjust ours by delegating read to Authenticated Users on the security tabs for each GP. It only applies raelly if you target group policy on the security group.