Some computer not updating their computer policy

[Ambient]

Hi all

 

I've got an issue with my network in that some of the computers (over 100 I think) are not updating their computer policy.

 

This problem only came to light when each of these computers in question restarted due to windows updates yesterday. I'd set all our computers to install the updates (via WSUS) at 20:00...however, these non updating ones in question all restarted (after performing the updates) at 15:00!!

 

Anyway, after further investigation, it seems that it’s not just the updating policy that isn't updating on them...it’s the whole computer policy. The strange thing is that in a room of 30 computers for example, some of them are fine, and some of them are not.

 

All of the policies in question are all being applied from the same OU (which every computer on the LAN should conform to)

 

Strange on this, and I hope it isn’t the start of something big.

 

Any ideas on how i could start to tackle this one?

 

The computer policy is set to update every 15 minutes (as a test, I’ve changed this to 10...and its worked on some...but not others)

[danrhodes]

Have your tried running "gpupdate /Force" on the affected machines from a cmd window.

 

You can also check which policies are applied by using "gpresult"

 

D

[Ambient]

It appears that running a GPupdate on he computer doesnt work too!...i'm going to search the event viewer for an answer to it now. I had to re-boot our DC over the weekend, and when it came back up....there were some odd DNS issues (causing AD not to work). But, when i'd got back to my computer after changing my keggs (after crapping mself)...it seemed to be all working fine again. I can't help but think it has something to do with that.

[Ambient]

a GPupdate/force appears to have updated the computer policy on the computer i'm testing on...but i can't afford to go round every comptuer and do this. I think perhaps another DC re-boot (well, all 3 AD servers) is needed.

[danrhodes]

Can you not add the GPupdate/force to your startup script for a few days?

 

D

[Ambient]

I just put a post up saying that a GPupdate /force fixed it on a comptuer i'm testing...however, after looking at it further...it actually hasn't.

 

Any more ideas guys?

[ajs]

What output do you get from gpresult?

[danrhodes]

You dont have a policy set as no override do you?

[Ambient]

That would have been my plan...but not any more, as that didnt work in the end

 

Great idea though.

[danrhodes]

post the output of your gpresult please aaron, also just make sure you have no policies set as no override.

 

It may be worth running DCdiag also to check your DC's are all talking!

 

D

[Ambient]

Not that i'm aware of, but i'll check. I've never actually used an override before...where is that set in AD?

 

I'm trying to work out a pattern to this problem, i.e. computers that are in the same OU etc. At the moment, there seems to be no pattern at all

[danrhodes]

If there is no pattern then its probably not the override that is set, try running DCDiag as it may be that the DC's scyning properly in this case the pc's would get the policy on their respective DC and if the policies arent replicating.....

[Ambient]

If there is no pattern then its probably not the override that is set, try running DCDiag as it may be that the DC's scyning properly in this case the pc's would get the policy on their respective DC and if the policies arent replicating.....

 

Yeah, that makes sense to me...and i bet thats the issue.

 

In order to post the GPResult, did you want it from the cmd? if so, i arent too sure how to copy the text.

 

Many thanks for your help

[danrhodes]

If you run gpresult, then right click on the cmd window (the black part) and select mark, you can then click and drag to highlight, then press Enter to copy the text, then paste it into here :-)

 

Get DCDiag running it doesnt take long!

http://www.computerperformance.co.uk/w2k3/utilities/windows_dcdiag.htm

 

D

[Ambient]

DCdiag result from our domain controller (1 of 3...and this is the main one with DNS and DHCP on it)

 

Microsoft Windows [Version 5.2.3790]

© Copyright 1985-2003 Microsoft Corp.

 

Z:\>cd..

 

Z:\>cd..

 

Z:\>c:

 

C:\>dcdiag

 

Domain Controller Diagnosis

 

Performing initial setup:

Done gathering initial info.

 

Doing initial required tests

 

Testing server: Default-First-Site\COOPER3K

Starting test: Connectivity

......................... COOPER3K passed test Connectivity

 

Doing primary tests

 

Testing server: Default-First-Site\COOPER3K

Starting test: Replications

......................... COOPER3K passed test Replications

Starting test: NCSecDesc

......................... COOPER3K passed test NCSecDesc

Starting test: NetLogons

......................... COOPER3K passed test NetLogons

Starting test: Advertising

......................... COOPER3K passed test Advertising

Starting test: KnowsOfRoleHolders

......................... COOPER3K passed test KnowsOfRoleHolders

Starting test: RidManager

......................... COOPER3K passed test RidManager

Starting test: MachineAccount

......................... COOPER3K passed test MachineAccount

Starting test: Services

......................... COOPER3K passed test Services

Starting test: ObjectsReplicated

......................... COOPER3K passed test ObjectsReplicated

Starting test: frssysvol

......................... COOPER3K passed test frssysvol

Starting test: frsevent

There are warning or error events within the last 24 hours after the

SYSVOL has been shared. Failing SYSVOL replication problems may cause

Group Policy problems.

......................... COOPER3K failed test frsevent

Starting test: kccevent

......................... COOPER3K passed test kccevent

Starting test: systemlog

An Error Event occured. EventID: 0x00000457

Time Generated: 06/10/2010 12:02:17

(Event String could not be retrieved)

An Error Event occured. EventID: 0x00000457

Time Generated: 06/10/2010 12:02:18

(Event String could not be retrieved)

......................... COOPER3K failed test systemlog

Starting test: VerifyReferences

......................... COOPER3K passed test VerifyReferences

 

Running partition tests on : TAPI3Directory

Starting test: CrossRefValidation

......................... TAPI3Directory passed test CrossRefValidation

 

Starting test: CheckSDRefDom

......................... TAPI3Directory passed test CheckSDRefDom

 

Running partition tests on : ForestDnsZones

Starting test: CrossRefValidation

......................... ForestDnsZones passed test CrossRefValidation

 

Starting test: CheckSDRefDom

......................... ForestDnsZones passed test CheckSDRefDom

 

Running partition tests on : DomainDnsZones

Starting test: CrossRefValidation

......................... DomainDnsZones passed test CrossRefValidation

 

Starting test: CheckSDRefDom

......................... DomainDnsZones passed test CheckSDRefDom

 

Running partition tests on : Schema

Starting test: CrossRefValidation

......................... Schema passed test CrossRefValidation

Starting test: CheckSDRefDom

......................... Schema passed test CheckSDRefDom

 

Running partition tests on : Configuration

Starting test: CrossRefValidation

......................... Configuration passed test CrossRefValidation

Starting test: CheckSDRefDom

......................... Configuration passed test CheckSDRefDom

 

Running partition tests on : cooper

Starting test: CrossRefValidation

......................... cooper passed test CrossRefValidation

Starting test: CheckSDRefDom

......................... cooper passed test CheckSDRefDom

 

Running enterprise tests on : cooper.intranet

Starting test: Intersite

......................... cooper.intranet passed test Intersite

Starting test: FsmoCheck

......................... cooper.intranet passed test FsmoCheck

 

C:\>

[Ambient]

I see a fail!

[ajs]

I see a fail!

 

...which helpfully tells you that it could affect Group Policy problems. I'm slightly shocked that an MS error message could be so helpful! :-)

 

Shame it doesn't tell you exactly how it failed but at least you've got a starting point.

[Ambient]

I removed some old and non-used policy's over the weekend. I did it through GPMC, i didnt just delete the folders from SYSVOL. I bet thats got something to do with this

[danrhodes]

Can you also post the output of "netdom query fsmo" just to check which servers have which roles!

[Ambient]

Can you also post the output of "netdom query fsmo" just to check which servers have which roles!

 

Is that part of the same DCdiag?

[danrhodes]

No run "netdom query fsmo" in a cmd window it will tell you which server have which FSMO roles, just to make sure there are no mix ups!

[Ambient]

C:\>netdom query fsmo

Schema owner cooper3k.cooper.intranet

 

Domain role owner cooper3k.cooper.intranet

 

PDC role cooper3k.cooper.intranet

 

RID pool manager cooper3k.cooper.intranet

 

Infrastructure owner cooper3k.cooper.intranet

 

The command completed successfully.

 

 

Which is as it all should be i think...

[danrhodes]

No mix ups then, well as this seems to be a FRS issue try running FRSDiag - http://www.microsoft.com/downloads/details.aspx?FamilyId=43CB658E-8553-4DE7-811A-562563EB5EBF&displaylang=en

 

Also may be helpfull - Recovering missing FRS objects and FRS attributes in Active Directory

[Ambient]

FRSdiag is running now

[danrhodes]

Good just going for lunch, back soon :-)