Group Policy Manager error

[leco]

I have umpteen event messages relating to Group Policy Manager:( Seems that the computer cannot find the specified path. I cannot access any of the policies including the domain default.

 

This is on a recently installed server so I am setting up users etc. or rather migrating them from the old 2003 server. Any ideas please as I'm not sure what to do to rectify the situation.

[Diello]

What does dcdiag report? Is SYSVOL shared? What are the Event Log messages exactly?

[Michael]

It's difficult to say without knowing what steps you've completed so far. I'm guessing you've joined a 2008 Server to an existing 2003 Domain, promoted it to a domain controller and then attempting to open/modify GPOs?

[leco]

What does dcdiag report? Is SYSVOL shared? What are the Event Log messages exactly?

Diagnostics report file path not found. SYSVOL is shared. Exact event logs - will report on tomorrow when I'm back at the coal face.

 

It's difficult to say without knowing what steps you've completed so far. I'm guessing you've joined a 2008 Server to an existing 2003 Domain, promoted it to a domain controller and then attempting to open/modify GPOs?

 

Yes, yes and yes. Long story but I got the folder redirects horribly wrong at first. So set up a test OU with a test user. I set one redirect and tested it on two machines, before moving on to the next, testing again. When I was satisfied that all the redirects were working as they should, I moved each user from their original OU into the new one, renamed their old folder so that I could copy any particular bits over later. I then logged on as the user, set up all the other things that required setting. All was going well as I tested each freshly made user on the two machines, even deleting their local to make sure that the server profile was being used. Part way through the afternoon I noticed I was having to set up things that should have come from the policy. Did a gpupdate but to no avail, went to the server and found all the event messages.

 

I have now made all the other users "by hand" copying the local to the server and moving the Document folder by right clicking and entering a path to the server.

 

I have obviously broken something along the way but what I have no idea. At some point in the afternoon I did get a message about MMC (?) when I closed the Server Manager window, could that be connected?

 

Sorry for the long post trying to figure out what is happening or has happened - I'm new to Server 2008 and not fully conversant with all the different tools. Well I know they are much the same but in different places which makes them harder to find.

 

Thanks for helping.

[Michael]

Part way through the afternoon I noticed I was having to set up things that should have come from the policy.

 

This definitely sounds like a replication problem. Could you confirm the 'File Replication Service' is running on both servers?

 

Then within Active Directory Sites and Services, force replication between both servers.

[leco]

This definitely sounds like a replication problem. Could you confirm the 'File Replication Service' is running on both servers?

 

Then within Active Directory Sites and Services, force replication between both servers.

 

On the 2003 server I was forever having to do that but thought it was something to do with the old/old server which has now been retired altogether. Thanks, will have a go at replication in the morning, I don't want to "disturb" any of the scheduled things that happen at this time of night.

[SYNACK]

Just a thought have you updated the domain schema to windows 2008 level (Windows Server 2008 ADPREP have you looked at using replication monitor. (Active Directory Replication Monitor)

[leco]

Just a thought have you updated the domain schema to windows 2008 level (Windows Server 2008 ADPREP have you looked at using replication monitor. (Active Directory Replication Monitor)

 

As the server was installed by the supplier I assumed adprep was carried out, will confirm with them tomorrow. I have used replmon previously on the 2003 server so maybe I should try that again. Thanks.

[Michael]

Surely the schema must have been upgraded otherwise you'd get no where at all? (I would of thought). I suppose in theory however due to the mis-matches this could/would stop replication performing successfully. I've never tried

 

Working on this theory your 2003 Server would create more problems than 2008 Server, which of course is newer. I suppose this depends also which of your domain controllers has the FSMO roles.

[leco]

DCdiag on the 2003 server shows all tests passed

 

However, on the 2008 server:

 

Not advertising as a time server - now sorted

 

FrsEvent replication error - now sorted

 

Still have failure on:

DFSREvent - There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems.

 

NCSecDesc - Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes In Filtered Set access rights for the naming context: DC=ForestDnsZones,DC=(domain name),DC=local

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes In Filtered Set access rights for the naming context: DC=DomainDnsZones,DC=(domain name),DC=local

 

SystemLog - 13 errors all on the same date differing times - An Error Event occurred. EventID: 0x00000422

Time Generated: 04/09/2009 14:49:54

EvtFormatMessage failed, error 15100 Win32 Error 15100.

(Event String (event log = System) could not be retrieved, error 0x3afc)

 

I've looked at the permissions in AD for the Enterprise Domain Controllers, that is set for reading or listing. Can you tell I'm not used to looking in there? Not actually sure what it should be. What do I do next?

Edited April 9, 2009 by leco

[Diello]

DFSREvent - A catch all error for problems in the last 24 hours, so not a specific problem in itself

 

NCSecDesc - Because "adprep /rodcprep" hasn't been run on your schema for an upgraded AD domain. Not a problem in itself & can be ignored if you're not going to be running RODCs, else just run RODCPrep anyway, not going to hurt anything. (Ref: Known Issues for Installing and Removing AD DS)

 

SystemLog - Did you manage to check they'd upgraded your schema to support W2k8?

 

Try running: "dsquery * cn=schema,cn=configuration,dc={domain},dc={suffix} -scope base -attr objectVersion” from a cmd prompt - result should be 44.

 

Also force replication "repadmin /syncall" and see if errors get thrown.

[leco]

NCSecDesc - Because "adprep /rodcprep" hasn't been run on your schema for an upgraded AD domain. Not a problem in itself & can be ignored if you're not going to be running RODCs, else just run RODCPrep anyway, not going to hurt anything. (Ref: Known Issues for Installing and Removing AD DS)

I've read that but as I'm not sure what RODC is for I haven't run it.

 

SystemLog - Did you manage to check they'd upgraded your schema to support W2k8?

How do I do that?

 

Try running: "dsquery * cn=schema,cn=configuration,dc={domain},dc={suffix} -scope base -attr objectVersion” from a cmd prompt - result should be 44.

 

Also force replication "repadmin /syncall" and see if errors get thrown.

 

Done both of those - result 44 and no errors (sounds like Mastermind!)

 

Update: Group Policy error events now popping up every 5 minutes on the dot (on the 2003 server it's called Userenv).

Edited April 9, 2009 by leco

[leco]

I've now discovered that the 2008 server has not been backing up all week. Apparently it isn't recognising the external hard drive that's plugged into one of the USB ports. What have I done to deserve this, after fighting for the budget to buy the server on the premise that the network would work better? Not a happy Easter bunny:( Edited April 9, 2009 by leco
punctuation

[Diello]

I've read that but as I'm not sure what RODC is for I haven't run it

 

Read-Only Domain Controller - a DC that holds a copy of AD, but is read-only, useful for branch-offices etc. (Think BDCs in NT4). Running adprep /rodcprep simply adds into the AD schema the structure necessary to support them. RODC is a rather niche feature, if you run RODC prep, it'll get rid of the errors, else, you can just ignore them.

 

Good (or bad, depending how you look at it) - 44 means they did upgrade your AD to support Server 2008.

 

What are the GP errors? Both the Server 2008 & Server 2003 errors would help.

 

The Server 2008 box isn't using the same name as an old DC server is it?

[leco]

Thanks for the explanation. Will note the GP error messages tomorrow and post them - unless of course some miracle happens overnight and they have disappeared. I can but hope.

[leco]

Meanwhile back in stately Waaayne Manor: This morning's episode of the long running saga of the missing GPT files:

 

From 2008 Server

Log Name: System

Source: Microsoft-Windows-GroupPolicy

Date: 10/04/2009 8:42:23 am

Event ID: 1058

Task Category: None

Level: Error

Keywords:

User: DOMAIN\username

Computer: server 2008.DOMAIN.local

Description:

The processing of Group Policy failed. Windows attempted to read the file \\DOMAIN.local\sysvol\DOMAIN.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

a) Name Resolution/Network Connectivity to the current domain controller.

b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).

c) The Distributed File System (DFS) client has been disabled.

Event Xml:

1058

0

2

0

1

0x8000000000000000

22303

System

server 2008.DOMAIN.local

4

840

1

2075

3

The system cannot find the path specified.

server.DOMAIN.local

 

Name="GPOCNName">CN={31B2F340-016D-11D2-945F-0C04FB984F9},CN=Policies,CN=System,DC=DOMAIN,DC=local

 

Name="FilePath">\\DOMAIN.local\sysvol\DOMAIN.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini

 

From the 2003 Server

Event Type: Error

Event Source: Userenv

Event Category: None

Event ID: 1030

Date: 10/04/2009

Time: 09:12 am

User: NT AUTHORITY\SYSTEM

Computer: SERVER

Description:

Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

 

Event Type: Error

Event Source: Userenv

Event Category: None

Event ID: 1058

Date: 10/04/2009

Time: 09:22 am

User: NT AUTHORITY\SYSTEM

Computer: SERVER

Description:

Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=DOMAIN,DC=local. The file must be present at the location <\\DOMAIN.local\sysvol\DOMAIN.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (The system cannot find the path specified. ). Group Policy processing aborted.

 

From an XP Client

Event Type: Error

Event Source: Userenv

Event Category: None

Event ID: 1030

Date: 10/04/2009

Time: 08:21:48

User: NT AUTHORITY\SYSTEM

Computer: STAFF-01

Description:

Windows cannot query for the list of Group Policy objects. A message that describes the reason for this was previously logged by the policy engine.

Event Type: Error

Event Source: Userenv

Event Category: None

Event ID: 1058

Date: 10/04/2009

Time: 08:21:48

User: NT AUTHORITY\SYSTEM

Computer: STAFF-01

Description:

Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=DOMAIN,DC=local. The file must be present at the location <\\DOMAIN.local\sysvol\DOMAIN.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (The system cannot find the path specified. ). Group Policy processing aborted.

 

I'm stabbing in the dark here, but is it a permissions issue? Is there a security setting somewhere that has been corrupted? Any suggestions would be more than gratefully received as I have come to the end of my limited server 2008 knowledge.

 

Many thanks.

Edited April 10, 2009 by leco