default computer policy problem

[standunstan]

help

 

can someone give me any pointers to this...

 

have a suite of XP PC's, half of these PCs pick up or default computer policy, the other half dont. They are all of the same spec, have tried clearing the dhcp scope, re-imaging, and readding to network, but the problem doesn't seem to shift.

 

help

[Geoff]

DNS issue? Do the clients have the DC(s) as their primary domain server? what does netdiag/dcdiag thing? What about the GPMC when you do modelling/results?

[CM786]

Hi mate,

 

I assume your connected to a server and have problems with your clients picking up group policies from the server?

 

Is it always the same computers that cause the problem, even when you have reimaged?

 

What LAN card is installed on these PC's? I have had trouble in the past with SIS900 LAN chipset.

[Guest]

Are you using the same computer names after re-imaging?

 

try removing the computer accounts from AD before re-imaging and give them new names post image.

[john]

have you tried logging on as an administrator on one of the machines and running the command GPUPDATE /FORCE and seeing if that helps?

[NetworkGeezer]

Are you using the same computer names after re-imaging?

 

try removing the computer accounts from AD before re-imaging and give them new names post image.

 

Good point. Are all the computers in the same OU/container?

 

Also as the are XP boxes, try using the GPResult command on a few sample boxes and see what reults you get.

[ajbritton]

Use Policy Reporter. This wonderful tool will help you to enable full USERENV debug level logging and then analyse the log for you to help make sense of it. If you pick through it (following a reboot of the PC), you should be able to see exactly what is going on.

 

I too have had problems with SIS900 LAN in combination with SOPHOS AntiVirus. This gave me various errors in the system log during boot up.

[Gatt]

SIS900 cards are annoying as hell - The PC's we get all have these as onboards so had to ask the supplier to ship them with some netgear cards installed and disable the SIS900's

 

Loads of problems include GPO problems as seen here, as well as duiring Ghosting - they time out from the casting whilst im trying to add other PC's to it!

[DMcCoy]

I suspect its only the drivers that are broken, you get the same issue with other card - mostly wireless. The driver initialises the network card too late and the machine misses the first chance to apply the domain policies - then it has to wait for another (default) 90 minutes before applying the policy. There is a value you can increase that will force group policy to wait longer for the network to initiaise.

 

http://support.microsoft.com/kb/840669/en-us

[NetworkGeezer]

Is there an equivalent of sfc for 3rd party drivers.

Is the Have Disk wizard the only way to force drivers back to their pristine state?

[ajbritton]

I suspect its only the drivers that are broken, you get the same issue with other card - mostly wireless. The driver initialises the network card too late and the machine misses the first chance to apply the domain policies - then it has to wait for another (default) 90 minutes before applying the policy. There is a value you can increase that will force group policy to wait longer for the network to initiaise.

 

http://support.microsoft.com/kb/840669/en-us

 

Yep, tried that. It did work on one site but then made no difference at another. The only way I could make it work was to use the driver supplied with XP SP2. I tried every other driver (the one supplied by the OEM and the latest from SIS), but they all had the same problem. Went back the the MS one and it worked OK.

 

The really nasty thing about it was that thought the PC thought it was no longer on the domain. All the existing policies removed and software uninstalled.

[Geoff]

There's a 'wait for network' GPO setting too. But you have that enabled already right?

[ajbritton]

Quite right.

[standunstan]

Have narrowed the problem down to 8 PCs and looking in the DC event viewer have this error message for all the PCs,

 

The session setup from computer '2RM22' failed because the security database does not contain a trust account '2RM22$' referenced by the specified computer.

 

Help............

[Geoff]

remove and rejoin them to the domain. You should probably delete the computer accounts before you rejoin them. Just to be safe.

[standunstan]

have done this a couple of times have even renamed one of the said PCs and rejoined but it still won't pick up the policy

[Dos_Box]

It does sound like a DNS problem to me. Do you have more than one domain controller and are zone transfers activated?

[ajbritton]

It does sound like a DNS problem to me. Do you have more than one domain controller and are zone transfers activated?

 

Hmmm...How would that cause the errors on the DC?

[Geoff]

Because it can't find itself.

[standunstan]

yes to both your questions but if it cant find itself would it not be able to join the domain

[Geoff]

Yes it would, via RPC.

[standunstan]

so my solution would be...............

[Geoff]

run netdiag on the broken clients. It sounds like the secure channel has broken though.

[standunstan]

ok,

 

ran the support tools from server disk and came up with this error

 

The procedure entry point DnsGetMaxNumberOfAddressToRegister could not belocated in the dynamiclink library DNSAPI.dll." error when running netdiag on XP

 

then reinstalled support tools from XP cd as advised on google search and there is no netdiag file in the support tools folder, the download link on microsoft is no longer valid either

[Geoff]

netdiag is only present on the resource kit installation on the windows 2000 server CD.