Group Policy not applying (worked before network was turned off)

[Darylrese]

Hi Everyone,

 

Some weird issues started end of last week where machines were randomly not getting any group policies. Event Viewer displays:

 

The processing of group policy failed. Windows attempted to read the file DOMAIN\sysvol\Policies\GUID\gpt.ini from a domain controller and was not successful.

 

If you delete the DNS record of the affected machine and reboot, it seems to work for some users, but not others. It does logon and give the user a blank desktop and their documents but no mapped drives or some and others missing.

 

Any ideas?

 

Network had to be turned off entirely over the February half term for building work to take place.

 

Things I’ve tried:

 

Delete DNS record, release, renew, gpupdate /force, reboot

Delete local profiles

Forced replication between DCs

Rebooted all DCs

 

Deleting an affected workstations DNS record and rebooting seems to fix it for a short while then the problem returns

[TwistedHelixis]

If you are sure the hardware part of the network is 100% fine I would assume its an issue with the DNS server.

 

Do you have your DNS server set to delete old records every x days or not?

 

Check that DHCP records match those in DNS

[CREATISH]

Hi Everyone,

 

Some weird issues started end of last week where machines were randomly not getting any group policies. Event Viewer displays:

 

The processing of group policy failed. Windows attempted to read the file DOMAIN\sysvol\Policies\GUID\gpt.ini from a domain controller and was not successful.

 

If you delete the DNS record of the affected machine and reboot, it seems to work for some users, but not others. It does logon and give the user a blank desktop and their documents but no mapped drives or some and others missing.

 

Any ideas?

 

Network had to be turned off entirely over the February half term for building work to take place.

 

Things I’ve tried:

 

Delete DNS record, release, renew, gpupdate /force, reboot

Delete local profiles

Forced replication between DCs

Rebooted all DCs

 

Deleting an affected workstations DNS record and rebooting seems to fix it for a short while then the problem returns

 

Go to affected machine and do IPCONFIG /ALL

 

Then go to a working machine do the same thing, Cross refrence this to see any anomalities, if so investigate further on the issue

[Darylrese]

DNS Scavenging is set to 7 days.

 

DCdiag reports - FRS Event – There are warning or error events within last 24 hours after the sysvol has been shared. Failing Sysvol replication problems may cause group policy problems

Edited March 6, 2019 by Darylrese

[TwistedHelixis]

I am no DNS expert but if I was you (probably a better way of approaching this) I would turn off one of the DNS servers (the one you think might be an issue) and see if the issues continue or not.

[Edgehill]

Are the policy folders on each of your domain controllers the same size?

If you run "nslookup [your_domain]" from cmd does it show any unexpected entries?

If you check the .ini file, do the necessary users have read permissions to it?

[HPlum78]

@twistefhelxis I am going to guess that DNS is AD integrated and if you are going to take down a DC for more than just a reboot then you should be lowering the weight and priority of the DC locator service before you turn off a DC (even if it ain't AD integrated DNS). There are gpo settings for doing just this in /System/Net Logon/DC Locator DNS SRV records (Set Priority in the DC Locator DNS SRV Records and Specify DC locator DNS records not registered by the DC's) are the settings (you need to find the Mnemonics for the second setting)

 

Not sure that DNS is the issue here but the above will save you from introducing a whole new set of issues if you want to take a DC out of service for a while.