The processing of Group Policy failed

[Reecekellyy]

Hello, 

 

I hope this is an appropriate place for this. 

 

We've recently got a load of new laptops and I am sporadically getting an issue where GPO is not applying. When I login to a laptop, I can tell GPO has not been applied because the desktop icons haven't loaded, which are defined in a GPO. So I run a gpupdate /force and get the following message: 

 

Computer policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows attempted to read the file \\[DOMAINNAME]\SysVol\[DOMAINNAME]\Policies\{ED696DE2-2DA2-4F98-BFB9-851761F2C95C}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: 
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

User Policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows attempted to read the file \\[DOMAINNAME]\SysVol\[DOMAINNAME]\Policies\{A5F281DA-B79A-41AF-80E0-48E695A8CC5D}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: 
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

To diagnose the failure, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.

 

The odd thing is that this doesn't happen all the time, as it will occasionally apply GPO when I login first time. Then other times, I keep trying gpupdate /force and it eventually updates the policy, so I've no idea what is causing the inconsistency. If it was not updating at all, then I could maybe narrow down the issue, but because its sporadic, I have no clue. 

 

This issue only started appearing with these new devices and my introduction of using Intune/Autopilot to enroll devices from out of the box. I have been experimenting with using intune because I like having it install all the required software when it first sets up windows and it auto joins our on site domain. 

 

So our environment is hybrid. We have our onsite active directory which syncs to Microsoft 365 via Entra connect. I also have the Intune Connector for Active Directory running on our domain controller which domain joins the devices as part of the autopilot process. 

 

I've found that this setup is the most streamline way of 'imaging' new devices because once I gather the autopilot details from the new device and import them to intune, it's just a case of installing windows and intune does the rest. 

 

I have no idea if this is an intune issue, or a domain controller issue, or if i'm missing something completely. Apologies if this is really long to read, but I want to ensure I include as much detail as possible. 

 

Hope I've included enough information, any questions please ask and any advice would be appreciated, thanks for reading!

 

NOTE: In the 15ish minutes it took me to write this post, I have gone back to the same laptop, ran gpupdate again and it's worked. 

[3s-gtech]

How many DCs and DFS-R replicas for the sysvol? Is DFS-R replicating correctly?

 

Is DNS happy?

[Koldov]

Do you have a 'wait for network' GPO?

[6Foot2]

4 hours ago, 3s-gtech said:

How many DCs ...

 

As it sometimes works, is it always the same server not applying the policy?

 

There was a way to find out which server responded to the request, but I can't remember the details.

[Koldov]

In CMD

GPRESULT /R

That will give you a bit more information and tell you where Group Policy was applied from.

 

 

Edited May 14, 2025 by Koldov

[Reecekellyy]

18 hours ago, 3s-gtech said:

How many DCs and DFS-R replicas for the sysvol? Is DFS-R replicating correctly?

 

Is DNS happy?

2 DC's. Replication seems to be okay from what I've checked, my knowledge doesn't span too far in replication so I've just followed some guidance online and it looks like replication is fine. But I suspect it's not, how can I check for sure?

 

DNS is happy for both DC's. 

[Reecekellyy]

13 hours ago, 6Foot2 said:

 

As it sometimes works, is it always the same server not applying the policy?

 

There was a way to find out which server responded to the request, but I can't remember the details.

I've just turned on a laptop, GP wasn't applied so I did gpupdate /force and got the error I mentioned in my post. I did gpresult /r and it says policy was applied from DC01. I restarted the laptop, GP still not applied, gpupdate /force and got the same error, did gpresult /r again and this time it was applied from DC02

[3s-gtech]

15 minutes ago, Reecekellyy said:

2 DC's. Replication seems to be okay from what I've checked, my knowledge doesn't span too far in replication so I've just followed some guidance online and it looks like replication is fine. But I suspect it's not, how can I check for sure?

 

DNS is happy for both DC's. 

You can check replication by opening the sysvol on both, dive into the Policies folder, and make a text file on one. Check to see if it appears on the other. Then repeat the other way round.

[Reecekellyy]

4 minutes ago, 3s-gtech said:

You can check replication by opening the sysvol on both, dive into the Policies folder, and make a text file on one. Check to see if it appears on the other. Then repeat the other way round.

Thanks for that! Just done that and it appears replication is working fine. Created a file on DC01 which appeared on DC02, Created a file on DC02 which appeared on DC01. 

[chazzy2501]

system,login,wait...

 

 

[Reecekellyy]

2 minutes ago, chazzy2501 said:

system,login,wait...

 

 

Thanks for this, we do have this policy already applied.

[Reecekellyy]

19 hours ago, Koldov said:

Do you have a 'wait for network' GPO?

Yeah we do have this GPO

[Koldov]

Are you saying no Group Policies apply or just a specific one? I thought other policies would still apply...

 

"If one Group Policy setting fails to apply on a client computer, the rest of the settings in that Group Policy (GPO) and potentially other GPOs may still be applied. The client will attempt to reapply the failed setting at the next scheduled refresh, and the other settings are likely to be applied without issue. "

 

What was the output of GPRESULT /R (or RSOP.msc) does it list other policies applying. Also run GPRESULT /H GPReport.html as indicated in the error text.

 

The error text specifies one GUID of a policy.

 

If the issue is just one GPO, have you seen these?

 

https://learn.microsoft.com/en-us/answers/questions/1184338/hoe-to-fix-the-processing-of-group-policy-failed

 

https://learn.microsoft.com/en-us/answers/questions/733852/the-processing-of-group-policy-failed-windows-atte

 

 

Basically, check this file exists for the policy:

 

 

Edit the policy, see if it changes.

Edited May 14, 2025 by Koldov

[Koldov]

Can't remember where I got this, but I occasionally run this on my DCs:

 

#Query Role Holders

Netdom Query FSMO

#Query Domain

Get-ADDomain

#Query Forest

Get-ADForest

#Make sure that domain controllers are in sync and that replication is ongoing

Repadmin /replsummary

#Make sure that all the dependency services are running

$Services='DNS','DFS Replication','Intersite Messaging','Kerberos Key Distribution Center','NetLogon',’Active Directory Domain Services’
ForEach ($Service in $Services) {Get-Service $Service | Select-Object Name, Status}

#Domain Controller Diagnostic tool (DCDiag)

DCDiag /Test:DNS /e /v

#Detect unsecure LDAP binds

Get-WinEvent -FilterHashtable @{
                LogName = 'Security'
                    ID = 2889
                }

 

You need to press enter at the last one and it should return an error if it finds no unsecure LDAP binds.

Edited May 14, 2025 by Koldov

[machy]

If you go into GPO And find the policy with the guid of 

A5F281DA-B79A-41AF-80E0-48E695A8CC5D (you can find this under "Settings in gpo")

 

And they try changing something in the policy

I normally get it to try add a junk reg key or temp file when i have had the issue before.

Once GPUpdate is working you can remove what you added

 

 

i have had it before where a policy just decides to break, and making it so the user / computer policy version gets bumped sometimes fixes it

 

[Reecekellyy]

2 hours ago, machy said:

If you go into GPO And find the policy with the guid of 

A5F281DA-B79A-41AF-80E0-48E695A8CC5D (you can find this under "Settings in gpo")

 

And they try changing something in the policy

I normally get it to try add a junk reg key or temp file when i have had the issue before.

Once GPUpdate is working you can remove what you added

 

 

i have had it before where a policy just decides to break, and making it so the user / computer policy version gets bumped sometimes fixes it

 

Thanks, your message made me realise that the error message was literally telling me which policy wasn't being applied. So the policy GUID beginning with A5F2 was a policy related to Google Chrome and the policy GUID beginning with ED69 was a policy with locale settings. I unlinked both policies and restarted the laptop and did gpupdate /force and got 2 different GUIDs that failed to apply. This time, the always wait for network policy & a policy which sets some general taskbar settings. So I unlink those 2 policies, restart the laptop, do another gpupdate /force and now I am getting another GUID which can't apply and this one relates to a default internet browser. 

 

So it seems that when I unlink the 'problem' GPO's, something else becomes a problem. But like I've said, there's loads of devices that have these policies applied with no problems so I don't think the GPOs are the problem. 

[Reecekellyy]

3 hours ago, Koldov said:

Can't remember where I got this, but I occasionally run this on my DCs:

 

#Query Role Holders

Netdom Query FSMO

#Query Domain

Get-ADDomain

#Query Forest

Get-ADForest

#Make sure that domain controllers are in sync and that replication is ongoing

Repadmin /replsummary

#Make sure that all the dependency services are running

$Services='DNS','DFS Replication','Intersite Messaging','Kerberos Key Distribution Center','NetLogon',’Active Directory Domain Services’
ForEach ($Service in $Services) {Get-Service $Service | Select-Object Name, Status}

#Domain Controller Diagnostic tool (DCDiag)

DCDiag /Test:DNS /e /v

#Detect unsecure LDAP binds

Get-WinEvent -FilterHashtable @{
                LogName = 'Security'
                    ID = 2889
                }

 

You need to press enter at the last one and it should return an error if it finds no unsecure LDAP binds.

Thanks, I've ran these commands and everything looks normal apart from the 'Repadmin /replsummary' which returned: 

 

Source DSA          largest delta    fails/total %%   error
 DC01                  25m:35s    0 /   5    0
 DC02                 55d.03h:53m:18s    1 /   5   20  (8606) Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected.

Destination DSA     largest delta    fails/total %%   error
 DC01                   55d.03h:53m:18s    1 /   5   20  (8606) Insufficient attributes were given to create an object. This object may not exist because it may have been deleted and already garbage collected.
 DC02                  25m:35s    0 /   5    0

 

I must be honest, this could be completely normal but my knowledge doesn't stretch this far, I just saw error and assume that's bad.

[Koldov]

Can you put the laptop into an empty test OU, then link just one policy and see if it always processes it and then work up from there?

 

I get that sometimes they get the GPOs applied and sometimes don't, but is it completely random machines or do the same laptops always have the issue?

 

EDIT: FORGET THE ABOVE...

 

I don't normally see any errors and I don't think I've ever seen 55 days! There's something sticky going on there I think, they should be fairly similar, like within a minute or so (well mine usually are).

 

Source DSA          largest delta    fails/total %%   error
DC01                        38m:58s          0 /   5    0
DC02                       39m:06s          0 /   5    0

Destination DSA     largest delta    fails/total %%   error
DC01                          39m:06s       0 /   5    0
DC02                          38m:58s      0 /   5    0

 

Everything else passed OK though?

Edited May 14, 2025 by Koldov

[Reecekellyy]

47 minutes ago, Koldov said:

Can you put the laptop into an empty test OU, then link just one policy and see if it always processes it and then work up from there?

 

I get that sometimes they get the GPOs applied and sometimes don't, but is it completely random machines or do the same laptops always have the issue?

 

EDIT: FORGET THE ABOVE...

 

I don't normally see any errors and I don't think I've ever seen 55 days! There's something sticky going on there I think, they should be fairly similar, like within a minute or so (well mine usually are).

 

Source DSA          largest delta    fails/total %%   error
DC01                        38m:58s          0 /   5    0
DC02                       39m:06s          0 /   5    0

Destination DSA     largest delta    fails/total %%   error
DC01                          39m:06s       0 /   5    0
DC02                          38m:58s      0 /   5    0

 

Everything else passed OK though?

Yeah I thought 55 days was a bit high. 

 

Everything else seems okay (from what I can tell):

I've **'d any identifying information, no idea if that was necessary or not just thought it'd be safe.

 

C:\WINDOWS\system32> Netdom Query FSMO
Schema master               DC01.local
Domain naming master   DC01.local
PDC                                  DC01.local
RID pool manager            DC01.local
Infrastructure master      DC01.local
The command completed successfully.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\WINDOWS\system32> Get-ADDomain

AllowedDNSSuffixes                 : {}
ChildDomains                       : {}
ComputersContainer                 : CN=Computers,DC=**,DC=local
DeletedObjectsContainer            : CN=Deleted Objects,DC=**,DC=local
DistinguishedName                  : DC=**,DC=local
DNSRoot                            : **
DomainControllersContainer         : OU=Domain Controllers,DC=**,DC=local
DomainMode                         : Windows2012R2Domain
DomainSID                          : S-1-5-21-2670031880-**
ForeignSecurityPrincipalsContainer : CN=ForeignSecurityPrincipals,DC=**,DC=local
Forest                             : **
InfrastructureMaster               : DC01.local
LastLogonReplicationInterval       :
LinkedGroupPolicyObjects           : {cn={1184592F-CAFD-4B39-9793-FAF35FFAC059},cn=policies,cn=system,DC=CHS,DC=local,
                                     cn={D7862049-B621-4BE7-A475-09E1F72BFA16},cn=policies,cn=system,DC=CHS,DC=local,
                                     cn={61BAB1FD-8C01-4D7B-B1C3-C5F28688E552},cn=policies,cn=system,DC=CHS,DC=local, c
                                     n={AE0AD057-A353-4738-846F-EFE53471919B},cn=policies,cn=system,DC=CHS,DC=local...}
LostAndFoundContainer              : CN=LostAndFound,DC=**,DC=local
ManagedBy                          :
Name                               : **
NetBIOSName                        : **
ObjectClass                        : domainDNS
ObjectGUID                         : abffd92a-7a97-421e-b720-**
ParentDomain                       :
PDCEmulator                        : DC01.local
PublicKeyRequiredPasswordRolling   :
QuotasContainer                    : CN=NTDS Quotas,DC=**,DC=local
ReadOnlyReplicaDirectoryServers    : {}
ReplicaDirectoryServers            : {DC02.local, DC01.local}
RIDMaster                          : DC01.local
SubordinateReferences              : {DC=DomainDnsZones,DC=**,DC=local, DC=ForestDnsZones,DC=**,DC=local,
                                     CN=Configuration,DC=**,DC=local}
SystemsContainer                   : CN=System,DC=**,DC=local
UsersContainer                     : CN=Users,DC=**,DC=local

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\WINDOWS\system32> Get-ADForest

ApplicationPartitions : {DC=DomainDnsZones,DC=**,DC=local, DC=ForestDnsZones,DC=**,DC=local}
CrossForestReferences : {}
DomainNamingMaster    : DC01.local
Domains               : {**.local}
ForestMode            : Windows2012Forest
GlobalCatalogs        : {DC02.local, DC01.local}
Name                  : **.local
PartitionsContainer   : CN=Partitions,CN=Configuration,DC=**,DC=local
RootDomain            : **.local
SchemaMaster          : DC01.local
Sites                 : {**}
SPNSuffixes           : {}
UPNSuffixes           : {**}

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\WINDOWS\system32> $Services='DNS','DFS Replication','Intersite Messaging','Kerberos Key Distribution Center','NetLogon','Active Directory Domain Services'
>> ForEach ($Service in $Services) {Get-Service $Service | Select-Object Name, Status}

Name      Status
----      ------
DNS      Running
DFSR     Running
IsmServ  Running
Kdc      Running
Netlogon Running
NTDS     Running

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\WINDOWS\system32> DCDiag /Test:DNS /e /v

Summary of DNS test results:

                                            Auth Basc Forw Del  Dyn  RReg Ext
            _________________________________________________________________
            Domain: **.local
               DC02                     PASS PASS PASS PASS PASS PASS n/a
               DC01                     PASS PASS PASS PASS PASS PASS n/a

         ......................... **.local passed test DNS

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\WINDOWS\system32> Get-WinEvent -FilterHashtable @{
>>                 LogName = 'Security'
>>                     ID = 2889
>>                 }
Get-WinEvent : No events were found that match the specified selection criteria.

 

 

Edited May 14, 2025 by Reecekellyy

[psydii]

 

Some avenues to dig into / fix that error here: Troubleshoot replication error 8606 - Windows Server | Microsoft Learn

 

Some of the more concerning causes are  reverting a dc snapshot or introducing an improperly restored one from backup? (it can take months before that comes back to bite you)

and this one caused by a *default* setting in Windows Server:

Secure Time Seeding Recommendations for Windows Server - Windows Server | Microsoft Learn

 

[Koldov]

Did you run that code on both DCs?

 

I have trouble remembering yesterday, but did anything happen 55 days ago that might have changed the replication?

 

Also, didn't really see anything in that output, only the Domain/Forest level of 2012R2. What Server OS are you running?

 

*I cannot condone/advise you do any of the following*

 

A couple of internet search results seem to suggest running full DCDIAG:

 

dcdiag /c /v

 

This will be large as it is all tests and verbose output.

 

It showed there was a machine that was identified. The solution in one was to edit the registry to change the Strict Replication Consistency key  to enable loose replication consistency. Obviously that comes with the usual warnings and doesn't actually fix the problem...

 

https://community.spiceworks.com/t/error-8606-ad-replication/768737/14#:~:text=Jul 2020-,Okay%2C I’m not sure if I fixed the problem or just temporarily got rid of it and it will appear again. After running,-the command dcdiag

 

This is from the same link as the above post from @psydii I believe, as it's MS it's a tough read and way over my head, but talks more about loose replication and it's issues... tombstone life and using LoL (Lingering Object Liquidator).

 

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/replication-error-8606#:~:text=If the destination domain controller was configured to use loose replication consistency%2C the object would have been "reanimated" on the destination domain controller's copy of the directory

 

As does this article:

 

https://techcommunity.microsoft.com/discussions/microsoft-entra/resolution-of-active-directory-replication-error-8606-1988/2754291#:~:text=intentionally deleted. Resolution-,Resolution,-For our need

 

And this:

 

https://akhpark.wordpress.com/2014/07/03/active-directory-server-wont-replicate-if-one-of-the-server-was-offline-for-a-long-time/

 

Again, a warning of using any of this without proper research and understanding (and good backups).

Edited May 14, 2025 by Koldov

[machy]

55 Days could (ish) have been feb half term? 

some sort of update?

[Reecekellyy]

We've recently consolidated our servers and got all the main virtual machines onto 1 host. DC02 was migrated to the new host 103 days ago and DC01 was migrated (drumroll please...) 55 days ago. So clearly this is part of the issue. 

 

I am fairly inexperienced with servers and networks in general so we hire a consultant to do all the server heavy lifting. He dealt with getting things moved over to the new host. I did raise this problem with him but he couldn't work out what the issue was. We're planning on rebuilding the entire domain during the summer holidays, which will be great for me to learn what goes into it. I inherited this domain which was created 15+ yrs ago so I'm trying to get my head around all the intricacies. I guess I was just hoping I'd get this problem resolved before we rebuild the domain since we're due to get a load more new devices before the rebuild in the summer.  

 

I'll show him what I've found from you very helpful folk on here and see if he can piece it together.

[psydii]

Given the info relating to your migration 55 days ago, you might well have a USN rollback. Take a look at this article

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/detect-and-recover-from-usn-rollback

 

 

Are  you really standing up a new forest in 2025 when the cloud is just there **waves arms in the direction of 365** ? If so, you might be able to limp along until the summer rebuild without addressing it.

 

If, on the other hand,  your plan was in fact to just start again with the OU/GPOs but keep the computer and user accounts, you will need to fix this problem; I’d be looking to open a £300 support ticket with Microsoft to troubleshoot the issue before changing anyhing, some of the steps in these articles are one-way changes that cannot be undone, and having a product expert on the phone is invaluable for learning and managing stress and providing assurance upwards for senior management.
 

 

Edited May 14, 2025 by psydii

[Reecekellyy]

15 hours ago, psydii said:

Given the info relating to your migration 55 days ago, you might well have a USN rollback. Take a look at this article

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/detect-and-recover-from-usn-rollback

 

 

Are  you really standing up a new forest in 2025 when the cloud is just there **waves arms in the direction of 365** ? If so, you might be able to limp along until the summer rebuild without addressing it.

 

If, on the other hand,  your plan was in fact to just start again with the OU/GPOs but keep the computer and user accounts, you will need to fix this problem; I’d be looking to open a £300 support ticket with Microsoft to troubleshoot the issue before changing anyhing, some of the steps in these articles are one-way changes that cannot be undone, and having a product expert on the phone is invaluable for learning and managing stress and providing assurance upwards for senior management.
 

 

Thanks for this info. I do really want to go full cloud, I'll do my research and find out the best way to proceed!