Ambient Posted June 10, 2010 Posted June 10, 2010 Hi all I've got an issue with my network in that some of the computers (over 100 I think) are not updating their computer policy. This problem only came to light when each of these computers in question restarted due to windows updates yesterday. I'd set all our computers to install the updates (via WSUS) at 20:00...however, these non updating ones in question all restarted (after performing the updates) at 15:00!! Anyway, after further investigation, it seems that it’s not just the updating policy that isn't updating on them...it’s the whole computer policy. The strange thing is that in a room of 30 computers for example, some of them are fine, and some of them are not. All of the policies in question are all being applied from the same OU (which every computer on the LAN should conform to) Strange on this, and I hope it isn’t the start of something big. Any ideas on how i could start to tackle this one? The computer policy is set to update every 15 minutes (as a test, I’ve changed this to 10...and its worked on some...but not others)
danrhodes Posted June 10, 2010 Posted June 10, 2010 Have your tried running "gpupdate /Force" on the affected machines from a cmd window. You can also check which policies are applied by using "gpresult" D
Ambient Posted June 10, 2010 Author Posted June 10, 2010 It appears that running a GPupdate on he computer doesnt work too!...i'm going to search the event viewer for an answer to it now. I had to re-boot our DC over the weekend, and when it came back up....there were some odd DNS issues (causing AD not to work). But, when i'd got back to my computer after changing my keggs (after crapping mself)...it seemed to be all working fine again. I can't help but think it has something to do with that.
Ambient Posted June 10, 2010 Author Posted June 10, 2010 a GPupdate/force appears to have updated the computer policy on the computer i'm testing on...but i can't afford to go round every comptuer and do this. I think perhaps another DC re-boot (well, all 3 AD servers) is needed.
danrhodes Posted June 10, 2010 Posted June 10, 2010 Can you not add the GPupdate/force to your startup script for a few days? D
Ambient Posted June 10, 2010 Author Posted June 10, 2010 I just put a post up saying that a GPupdate /force fixed it on a comptuer i'm testing...however, after looking at it further...it actually hasn't. Any more ideas guys?
danrhodes Posted June 10, 2010 Posted June 10, 2010 You dont have a policy set as no override do you?
Ambient Posted June 10, 2010 Author Posted June 10, 2010 That would have been my plan...but not any more, as that didnt work in the end Great idea though.
danrhodes Posted June 10, 2010 Posted June 10, 2010 post the output of your gpresult please aaron, also just make sure you have no policies set as no override. It may be worth running DCdiag also to check your DC's are all talking! D
Ambient Posted June 10, 2010 Author Posted June 10, 2010 Not that i'm aware of, but i'll check. I've never actually used an override before...where is that set in AD? I'm trying to work out a pattern to this problem, i.e. computers that are in the same OU etc. At the moment, there seems to be no pattern at all
danrhodes Posted June 10, 2010 Posted June 10, 2010 If there is no pattern then its probably not the override that is set, try running DCDiag as it may be that the DC's scyning properly in this case the pc's would get the policy on their respective DC and if the policies arent replicating.....
Ambient Posted June 10, 2010 Author Posted June 10, 2010 If there is no pattern then its probably not the override that is set, try running DCDiag as it may be that the DC's scyning properly in this case the pc's would get the policy on their respective DC and if the policies arent replicating..... Yeah, that makes sense to me...and i bet thats the issue. In order to post the GPResult, did you want it from the cmd? if so, i arent too sure how to copy the text. Many thanks for your help
danrhodes Posted June 10, 2010 Posted June 10, 2010 If you run gpresult, then right click on the cmd window (the black part) and select mark, you can then click and drag to highlight, then press Enter to copy the text, then paste it into here :-) Get DCDiag running it doesnt take long! http://www.computerperformance.co.uk/w2k3/utilities/windows_dcdiag.htm D
Ambient Posted June 10, 2010 Author Posted June 10, 2010 DCdiag result from our domain controller (1 of 3...and this is the main one with DNS and DHCP on it) Microsoft Windows [Version 5.2.3790] © Copyright 1985-2003 Microsoft Corp. Z:\>cd.. Z:\>cd.. Z:\>c: C:\>dcdiag Domain Controller Diagnosis Performing initial setup: Done gathering initial info. Doing initial required tests Testing server: Default-First-Site\COOPER3K Starting test: Connectivity ......................... COOPER3K passed test Connectivity Doing primary tests Testing server: Default-First-Site\COOPER3K Starting test: Replications ......................... COOPER3K passed test Replications Starting test: NCSecDesc ......................... COOPER3K passed test NCSecDesc Starting test: NetLogons ......................... COOPER3K passed test NetLogons Starting test: Advertising ......................... COOPER3K passed test Advertising Starting test: KnowsOfRoleHolders ......................... COOPER3K passed test KnowsOfRoleHolders Starting test: RidManager ......................... COOPER3K passed test RidManager Starting test: MachineAccount ......................... COOPER3K passed test MachineAccount Starting test: Services ......................... COOPER3K passed test Services Starting test: ObjectsReplicated ......................... COOPER3K passed test ObjectsReplicated Starting test: frssysvol ......................... COOPER3K passed test frssysvol Starting test: frsevent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. ......................... COOPER3K failed test frsevent Starting test: kccevent ......................... COOPER3K passed test kccevent Starting test: systemlog An Error Event occured. EventID: 0x00000457 Time Generated: 06/10/2010 12:02:17 (Event String could not be retrieved) An Error Event occured. EventID: 0x00000457 Time Generated: 06/10/2010 12:02:18 (Event String could not be retrieved) ......................... COOPER3K failed test systemlog Starting test: VerifyReferences ......................... COOPER3K passed test VerifyReferences Running partition tests on : TAPI3Directory Starting test: CrossRefValidation ......................... TAPI3Directory passed test CrossRefValidation Starting test: CheckSDRefDom ......................... TAPI3Directory passed test CheckSDRefDom Running partition tests on : ForestDnsZones Starting test: CrossRefValidation ......................... ForestDnsZones passed test CrossRefValidation Starting test: CheckSDRefDom ......................... ForestDnsZones passed test CheckSDRefDom Running partition tests on : DomainDnsZones Starting test: CrossRefValidation ......................... DomainDnsZones passed test CrossRefValidation Starting test: CheckSDRefDom ......................... DomainDnsZones passed test CheckSDRefDom Running partition tests on : Schema Starting test: CrossRefValidation ......................... Schema passed test CrossRefValidation Starting test: CheckSDRefDom ......................... Schema passed test CheckSDRefDom Running partition tests on : Configuration Starting test: CrossRefValidation ......................... Configuration passed test CrossRefValidation Starting test: CheckSDRefDom ......................... Configuration passed test CheckSDRefDom Running partition tests on : cooper Starting test: CrossRefValidation ......................... cooper passed test CrossRefValidation Starting test: CheckSDRefDom ......................... cooper passed test CheckSDRefDom Running enterprise tests on : cooper.intranet Starting test: Intersite ......................... cooper.intranet passed test Intersite Starting test: FsmoCheck ......................... cooper.intranet passed test FsmoCheck C:\>
ajs Posted June 10, 2010 Posted June 10, 2010 I see a fail! ...which helpfully tells you that it could affect Group Policy problems. I'm slightly shocked that an MS error message could be so helpful! :-) Shame it doesn't tell you exactly how it failed but at least you've got a starting point.
Ambient Posted June 10, 2010 Author Posted June 10, 2010 I removed some old and non-used policy's over the weekend. I did it through GPMC, i didnt just delete the folders from SYSVOL. I bet thats got something to do with this
danrhodes Posted June 10, 2010 Posted June 10, 2010 Can you also post the output of "netdom query fsmo" just to check which servers have which roles!
Ambient Posted June 10, 2010 Author Posted June 10, 2010 Can you also post the output of "netdom query fsmo" just to check which servers have which roles! Is that part of the same DCdiag?
danrhodes Posted June 10, 2010 Posted June 10, 2010 No run "netdom query fsmo" in a cmd window it will tell you which server have which FSMO roles, just to make sure there are no mix ups!
Ambient Posted June 10, 2010 Author Posted June 10, 2010 C:\>netdom query fsmo Schema owner cooper3k.cooper.intranet Domain role owner cooper3k.cooper.intranet PDC role cooper3k.cooper.intranet RID pool manager cooper3k.cooper.intranet Infrastructure owner cooper3k.cooper.intranet The command completed successfully. Which is as it all should be i think...
danrhodes Posted June 10, 2010 Posted June 10, 2010 No mix ups then, well as this seems to be a FRS issue try running FRSDiag - http://www.microsoft.com/downloads/details.aspx?FamilyId=43CB658E-8553-4DE7-811A-562563EB5EBF&displaylang=en Also may be helpfull - Recovering missing FRS objects and FRS attributes in Active Directory
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now