Fazza Posted February 28, 2022 Posted February 28, 2022 Bit of a strange one here, the Group Policies that provide everything from printer settings to stopping the 'little rascals' from accessing the command prompt or the registry editor are simply not working and they can do all sorts of things on the computers that they shouldnt! It's affecting both staff and student computers and causing all sorts of issues. The thing is though, it's not the first School that I'm aware of having this issue - there's another secondary school up the road having the same issue. I'm wondering if theres a windows update or something that has done something to stop them working? I need to get to the bottom of this ASAP before the 'little rascals' start causing havoc and destroying the computers!
jthompson Posted February 28, 2022 Posted February 28, 2022 One thing that springs to mind is DNS. Check that affected clients are able to resolve DC hostnames okay.
synaesthesia Posted February 28, 2022 Posted February 28, 2022 (edited) "little rascals" is very diplomatic! We spotted something vaguely similar a week or so ago which was down to DHCP (which in turn affected DNS) which was indeed down to a windows update - in our case it was failover replication to the other DC's which fell and broke lease reservations. I've just had a rootle through my browsing history to find the resolution but I've also just realised just how many sites I frequent in a week - needle in a haystack! Edit - found it. Getting old and my search-fu is getting weak! https://support.microsoft.com/en-us/topic/event-id-20291-is-logged-in-the-system-log-when-a-client-computer-is-moved-to-a-different-ip-network-9efe01da-8513-d94a-5b1d-9c9c2f02a727 Edited February 28, 2022 by synaesthesia
dmason2 Posted February 28, 2022 Posted February 28, 2022 second this, maybe run a ipconfig /flushdns & ipconfig /registerdns and then a gpupdate /force
Fazza Posted February 28, 2022 Author Posted February 28, 2022 One thing that springs to mind is DNS. Check that affected clients are able to resolve DC hostnames okay. I've checked and they can ping random servers OK (they shouldnt be able to as the command prompt is supposed to be blocked by a group policy)! I've also run dcdiag on the domain controllers and only one DNS error comes up to do with PaperCut so that will need looking at another day. "little rascals" is very diplomatic! We spotted something vaguely similar a week or so ago which was down to DHCP (which in turn affected DNS) which was indeed down to a windows update - in our case it was failover replication to the other DC's which fell and broke lease reservations. I've just had a rootle through my browsing history to find the resolution but I've also just realised just how many sites I frequent in a week - needle in a haystack! Edit - found it. Getting old and my search-fu is getting weak! https://support.microsoft.com/en-us/topic/event-id-20291-is-logged-in-the-system-log-when-a-client-computer-is-moved-to-a-different-ip-network-9efe01da-8513-d94a-5b1d-9c9c2f02a727 Thanks for that, I'll take a look right now and see what it says second this, maybe run a ipconfig /flushdns & ipconfig /registerdns and then a gpupdate /force I hope this isnt the solution as we have hundreds of computers and it will be pretty much impossible to run on them all. Just to be clear, from the sounds of it, the problem has been around for a few weeks but it's only just been brought to our attention.
Fazza Posted February 28, 2022 Author Posted February 28, 2022 Edit - found it. Getting old and my search-fu is getting weak! https://support.microsoft.com/en-us/topic/event-id-20291-is-logged-in-the-system-log-when-a-client-computer-is-moved-to-a-different-ip-network-9efe01da-8513-d94a-5b1d-9c9c2f02a727 Thanks for the link but it's for an update from 2014 for Server 2012R2 and I've just checked and the servers here are 2019.
jthompson Posted February 28, 2022 Posted February 28, 2022 Any clues in the System event log on affected clients?
Fazza Posted February 28, 2022 Author Posted February 28, 2022 second this, maybe run a ipconfig /flushdns & ipconfig /registerdns and then a gpupdate /force Made no difference - kinda glad in a way as I'm hoping for a solution I can do the server end rather than having to go around hundreds of computers to apply a fix
Koldov Posted February 28, 2022 Posted February 28, 2022 (edited) Any clues in the System event log on affected clients? This... as always (and Group Policy section), also what happens when you GPUDATE /FORCE on one of the affected machines? Does RSOP/GPRESULT show anything? Edited February 28, 2022 by Koldov
Fazza Posted February 28, 2022 Author Posted February 28, 2022 I've been in a meeting and had other things to do so only just been able to take another look at this issue. GPRESULT shows that no group policies are applied. It confirms the test PC I am now using is in the correct OU. An OU which has 6 computer group policies applied directly to the OU. This is very odd.
ivantalboys Posted February 28, 2022 Posted February 28, 2022 Do you have Authenticated Users or Domain Computers delegated to the GPOs? Its a fairly old issue but a security update to group policy changed some behaviour that can stop policies being applied. https://support.microsoft.com/en-us/topic/ms16-072-security-update-for-group-policy-june-14-2016-7570425d-d460-3003-b2ac-a464c874725d
kevin_lane Posted February 28, 2022 Posted February 28, 2022 Do you have any block inheritance or is there a policy overriding another policy for the same setting ? Is ad replicating OK? Do you have any strange WMI filters? Have you tried removing the device from the domain and back on again ? - this removes all policies from the device when dropped off
Fazza Posted March 1, 2022 Author Posted March 1, 2022 I know group policies were working 2-3 weeks ago as the 'little rascals' had discovered VPN plugins to Edge so along with getting the ISP to block the stores their end, I used a Group Policy setting to stop extensions working and that all tested OK so something has happened in the last couple of weeks to stop ALL group policies from working on the computers. I was in meetings a lot yesterday so didnt have much time to investigate properly... First thing this morning I picked a random computer in a suite and run GPRESULT and the odd thing is this: Applied Group Policy Objects ----------------------------- N/A The following GPOs were not applied because they were filtered out
Fazza Posted March 1, 2022 Author Posted March 1, 2022 Do you have any block inheritance or is there a policy overriding another policy for the same setting ? Yes inheritance is blocked but there are only a couple of Group Policies at the root and at least 6 computer based policies applied directly to the OU that the computers are in. Is ad replicating OK? I believe so, I did some DCDIAG tests on the Domain Controllers yesterday and the only error that came up was an incorrectly configured DNS entry for PaperCut (something I need to look in to another day). Do you have any strange WMI filters? Not that I can see. Have you tried removing the device from the domain and back on again ? - this removes all policies from the device when dropped off I've just re-imaged a spare PC and the issue is still occurs.
jthompson Posted March 1, 2022 Posted March 1, 2022 I know group policies were working 2-3 weeks ago as the 'little rascals' had discovered VPN plugins to Edge so along with getting the ISP to block the stores their end, I used a Group Policy setting to stop extensions working and that all tested OK so something has happened in the last couple of weeks to stop ALL group policies from working on the computers. I was in meetings a lot yesterday so didnt have much time to investigate properly... First thing this morning I picked a random computer in a suite and run GPRESULT and the odd thing is this: Applied Group Policy Objects ----------------------------- N/A The following GPOs were not applied because they were filtered out That looks promising in that is suggests that there's still an exchange going on between clients and DCs. Is there anything else on the end of that error message? Might be worth checking that your GPO links are actually enabled where you have them linked to OUs, and that the 'GPO Status' option on affected GPOs is set to 'Enabled' (i.e. you've not got user and/or computer settings disabled where you don't want them to be). It would be strange that that would get switched in bulk by accident, but worth checking in the same way that one might check that something is plugged in. From the look of that error message, though, it might be the 'Security filtering' that's creating the issue.
Fazza Posted March 1, 2022 Author Posted March 1, 2022 Is there anything else on the end of that error message? Here it is in full (with server names etc. redacted): Microsoft ® Windows ® Operating System Group Policy Result tool v2.0 c Microsoft Corporation. All rights reserved. Created on ?01/?03/?2022 at 08:03:58 RSOP data for ******\******** on ******-****** : Logging Mode ------------------------------------------------------ OS Configuration: Member Workstation OS Version: 10.0.19042 Site Name: N/A Roaming Profile: \\*****\***********\Student_Profile.V6 Local Profile: C:\Users\******** Connected over a slow link?: No USER SETTINGS -------------- CN=ictspare,OU=2018Intake,OU=Students,OU=******,DC=******,DC=****** Last time Group Policy was applied: 01/03/2022 at 08:01:38 Group Policy was applied from: ******.******.****** Group Policy slow link threshold: 500 kbps Domain Name: HSC Domain Type: Windows 2008 or later Applied Group Policy Objects ----------------------------- N/A The following GPOs were not applied because they were filtered out ------------------------------------------------------------------- Local Group Policy Filtering: Not Applied (Empty) The user is a part of the following security groups --------------------------------------------------- Domain Users Everyone BUILTIN\Users NT AUTHORITY\INTERACTIVE CONSOLE LOGON NT AUTHORITY\Authenticated Users This Organization LOCAL students Student Menu ****** 2018Intake Authentication authority asserted identity Medium Mandatory Level
Fazza Posted March 1, 2022 Author Posted March 1, 2022 Might be worth checking that your GPO links are actually enabled where you have them linked to OUs, and that the 'GPO Status' option on affected GPOs is set to 'Enabled' (i.e. you've not got user and/or computer settings disabled where you don't want them to be). It would be strange that that would get switched in bulk by accident, but worth checking in the same way that one might check that something is plugged in. From the look of that error message, though, it might be the 'Security filtering' that's creating the issue. If it was just one group policy not working I could understand it and investigate that. But for ALL group policies to stop working is very odd. They all appear to be enabled: And security filtering is set to Authenticated Users (which is what I would expect to see): The error does say it's something to do with the security filtering but that hasnt been changed on any of the group policies let alone ALL of them and as you can see it's set to Authenticated Users which is the correct/default setting I believe?
chazzy2501 Posted March 1, 2022 Posted March 1, 2022 (edited) From the "group policy management" use the group policy modelling wizard! (pick a pupil and a pupil computer) see what it expects to apply. (rule out dns issues etc.) Then run a results GPO on an actual pc for a report. EDIT: you can just pick the containers.. (also GPOs that were successfully applied may still be WMI filtered.) Edited March 1, 2022 by chazzy2501
jthompson Posted March 1, 2022 Posted March 1, 2022 This section The following GPOs were not applied because they were filtered out ------------------------------------------------------------------- Local Group Policy Filtering: Not Applied (Empty) is fine, as its just referring to the local group policy. It's this section Applied Group Policy Objects ----------------------------- N/A which should list all the GPOs for your user configuration. Do you know if you've got loopback processing in place on any of the GPOs applied to the computer(s)? I've a feeling that that might cause those GPOs to win out over your user GPOs.
Koldov Posted March 1, 2022 Posted March 1, 2022 Is this just user setting or computer, or both? Can you try creating a fresh test OU, then a GPO and move a client into it (or a user)?
clareq Posted March 1, 2022 Posted March 1, 2022 I've had something similar when a loopback policy was set in error to replace, not merge. It might be worth creating a user OU and computer OU with inheritance disabled, pop a test user and test machine in as appropriate, and adding the GPOs one at a time, rebooting and testing as you go.
Fazza Posted March 2, 2022 Author Posted March 2, 2022 This morning I've managed to get some more time to look in to this issue. I have a freshly imaged desktop which I have placed in to an OU that is used for testing along with a test user account: Now when I do a GPRESULT /R a couple of the Group Policies are being applied, but one is not: Here's a screenshot from Group Policy Management showing what should be being applied: Why is the STUDENT - Lockdown Settings not listed as being applied? All this does is have a setting for Edge to stop Extensions from being installed/used.
Koldov Posted March 2, 2022 Posted March 2, 2022 And is that (GPO for Edge to stop Extensions from being installed/used) a Computer or User GPO?
Fazza Posted March 2, 2022 Author Posted March 2, 2022 And is that (GPO for Edge to stop Extensions from being installed/used) a Computer or User GPO? A computer one with the loopback processing enabled. In my mind of thinking, even if it is not being applied for a reason, GPRESULT should be showing it as not being applied? I've not added all of the other group policies to the Test OU yet, I shall add them one by one and test after I've had some lunch!
jthompson Posted March 2, 2022 Posted March 2, 2022 Your GPRESULT output is displaying what the User COnfig side is up to. I'd recommend running gpresult -h C:\temp\gpres.htm And opening the output file to look for further clues. 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now