Some very weird GP/permissions shenanigans?

[Garacesh]

Currently myself and my tech's profiles are local. We have a homedrive set on our AD user object (Z:) just like anybody else but unlike everyone else there's no folder redirection in place, so if our machines die that's goodbye to a lot of stuff. Obviously this is not ideal.

 

So I create a folder redirection policy, mapping Documents to Z:\, Videos, Music and Pictures to Follow the documents folder, and explicitly naming Downloads and Favourites as respective subfolders of Z: since the follow option isn't available. None of these policies have the Grant the user exclusive rights..., Move the contents... or Also apply redirection policy to Windows 2000... boxes ticked.

 

Awesome! GPUpdate, reboot, show me the money desktop! Aaand nope. Nada.

 

GPResult says:

The system calls to access specified file completed. 
\\domain.local\SysVol\domain.local\Policies\{GUID}\gpt.ini
The call failed after 0 milliseconds.

 

The processing of Group Policy failed. Windows attempted to read the file \\domain.local\SysVol\domain.local\Policies\{GUID}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled

 

Except that \\domain.local\SysVol\domain.local\Policies\{GUID}\gpt.ini absolutely exists, and has Read & Execute permissions for Authenticated Users (amongst other ACL's)

 

But here's where it gets really weird.

With this failed GPO in place, I can't change any GPO's. It's like it screws up my domain admin rights or something.

If I try to make changes, I get Network access is denied. I can, however, delete the GPO link, reboot, and get my permissions back.

 

Why on earth would a failed folder redirection GPO be screwing up administrative permissions?

Or is something bigger more fundamentally broken than I'm realising?

 

Extra/random info

1. I've also tried %HOMESHARE%, also Redirect to the user's home directory for the Documents redirection.
   
2. The event logs did originally read Windows failed to apply the Folder Redirection settings. Folder Redirection settings might have its own log file. Please click on the "More information" link. which was, of course, a dead link, and carry an error code of 1003. Bizarrely, I can't seem to find these logs any more.
   
3. The folder redirection GPO is created from scratch, and has exactly the same permissions as every other GPO.
   

Edited November 17, 2020 by Garacesh

[Mako]

I'm sure it's something simple...

 

But first thing I'd check with those symptoms would be a DCDIAG and check replication too. Check the presence of the GPO across your DC's.

 

When that error occurs it can bugger up further policy processing, which is likely why it's affecting your permissions.

[Boredguy]

If you have any filtering set on the GPO to only apply to Admin users and not all authorised users, make sure in the Delegation tab within the GPMC you have Domain Computers set as Read permission so it can actually try to apply the policy

[Garacesh]

But first thing I'd check with those symptoms would be a DCDIAG and check replication too.

Ooooooh, tha's not good!

 

      Starting test: Replications
        [Replications Check,DC-Zero] A recent replication attempt failed:
           From DC-Two to DC-Zero
           Naming Context: DC=ForestDnsZones,DC=domain,DC=local
           The replication generated an error (1256):
           The remote system is not available. For information about network troubleshooting, see Windows
           The failure occurred at 2020-11-17 13:35:32.
           The last success occurred at 2020-11-16 23:46:57.
           41 failures have occurred since the last success.
        [DC-Two] DsBindWithSpnEx() failed with error 1722,
        The RPC server is unavailable..
        [Replications Check,DC-Zero] A recent replication attempt failed:
           From DC-Two to DC-Zero
           Naming Context: DC=DomainDnsZones,DC=domain,DC=local
           The replication generated an error (1256):
           The remote system is not available. For information about network troubleshooting, see Windows
           The failure occurred at 2020-11-17 13:35:32.
           The last success occurred at 2020-11-16 23:42:01.
           41 failures have occurred since the last success.
        [Replications Check,DC-Zero] A recent replication attempt failed:
           From DC-Two to DC-Zero
           Naming Context: CN=Schema,CN=Configuration,DC=domain,DC=local
           The replication generated an error (1722):
           The RPC server is unavailable.
           The failure occurred at 2020-11-17 13:36:56.
           The last success occurred at 2020-11-16 01:49:54.
           98 failures have occurred since the last success.
           The source remains down. Please check the machine.
        [Replications Check,DC-Zero] A recent replication attempt failed:
           From DC-Two to DC-Zero
           Naming Context: CN=Configuration,DC=domain,DC=local
           The replication generated an error (1722):
           The RPC server is unavailable.
           The failure occurred at 2020-11-17 13:36:14.
           The last success occurred at 2020-11-16 23:48:07.
           41 failures have occurred since the last success.
           The source remains down. Please check the machine.
        [Replications Check,DC-Zero] A recent replication attempt failed:
           From DC-Two to DC-Zero
           Naming Context: DC=domain,DC=local
           The replication generated an error (1722):
           The RPC server is unavailable.
           The failure occurred at 2020-11-17 13:35:32.
           The last success occurred at 2020-11-16 23:47:04.
           41 failures have occurred since the last success.
           The source remains down. Please check the machine.
        ......................... DC-Zero failed test Replications

Starting test: Replications
        [Replications Check,DC-Three] A recent replication attempt failed:
           From DC-two to DC-Three
           Naming Context: DC=ForestDnsZones,DC=domain,DC=local
           The replication generated an error (1256):
           The remote system is not available. For information about network troubleshooting, see Windows Help.
           The failure occurred at 2020-11-17 13:46:12.
           The last success occurred at 2020-11-16 23:45:38.
           41 failures have occurred since the last success.
        [DC-Two] DsBindWithSpnEx() failed with error 1722,
        The RPC server is unavailable..
        [Replications Check,DC-Three] A recent replication attempt failed:
           From DC-Two to DC-Three
           Naming Context: DC=DomainDnsZones,DC=domain,DC=local
           The replication generated an error (1256):
           The remote system is not available. For information about network troubleshooting, see Windows Help.
           The failure occurred at 2020-11-17 13:46:12.
           The last success occurred at 2020-11-16 23:45:38.
           41 failures have occurred since the last success.
        [Replications Check,DC-Three] A recent replication attempt failed:
           From DC-Two to DC-Three
           Naming Context: CN=Schema,CN=Configuration,DC=domain,DC=local
           The replication generated an error (1722):
           The RPC server is unavailable.
           The failure occurred at 2020-11-17 13:47:37.
           The last success occurred at 2020-11-16 23:45:38.
           41 failures have occurred since the last success.
           The source remains down. Please check the machine.
        [Replications Check,DC-Three] A recent replication attempt failed:
           From DC-Two to DC-Three
           Naming Context: CN=Configuration,DC=domain,DC=local
           The replication generated an error (1722):
           The RPC server is unavailable.
           The failure occurred at 2020-11-17 13:46:54.
           The last success occurred at 2020-11-16 23:45:32.
           41 failures have occurred since the last success.
           The source remains down. Please check the machine.
        [Replications Check,DC-Three] A recent replication attempt failed:
           From DC-Two to DC-Three
           Naming Context: DC=domain,DC=local
           The replication generated an error (1722):
           The RPC server is unavailable.
           The failure occurred at 2020-11-17 13:46:12.
           The last success occurred at 2020-11-16 23:46:32.
           41 failures have occurred since the last success.
           The source remains down. Please check the machine.
        ......................... DC-Three failed test Replications

 

Similar results from the others, except for the primary one, which says everything is A-OK, just nothing since half past midnight.

Edited November 17, 2020 by Garacesh

[Mako]

Uh oh, spaghettiOs...

[Garacesh]

After some digging, it turned out one of my Hyper-V hosts had died over the weekend, and for some reason when it brought the DC back up it hadn't bothered to connect it to the virtual switch

But since that was a CLI-only VM (because...? Reasons? I didn't build it), it was only doing DNS and authenticating logins, and we've got three others, I decided just to nix it entirely.

 

Big thanks to @BKGarry for his assistance

[BKGarry]

Glad to be of service and help you with it.

 

Stupid things that are not easy to see when you are in the thick of it at times.

 

Your next step is to follow these, once you have some "Strong and Stable" DCs https://techcommunity.microsoft.com/t5/storage-at-microsoft/streamlined-migration-of-frs-to-dfsr-sysvol/ba-p/425405