GPO's not being applied after upgrade to 2008 R2

[bmittleider]

I recently just upgraded my PDC from 2008 to 2008 R2 and after what I thought was a smooth upgrade I have come to find that GPO's are not being applied to anyone (Windows XP or 7, Server 2003, or Server 2008 R2). During the process of upgrading I also upgraded the Domain Functional Level from 2003 to 2008 R2 as this is our only DC and thought this was a logical solution. Now not even the simplest GPO is applied to clients. I have created new GPO's to test and even those don't apply. Did I miss something?

[p858snake]

try doing "gpupdate /force"?

[bmittleider]

Have done that on both the server and clients. The only thing that I noticed there was after the User/Computer Policy Refresh has completed line there is a line that reads: To check for errors in policy processing, review the event log. Which I have done and there are no errors or warnings.

 

Edit: I have even disjoined the domain and rejoined and no change.

Edited July 26, 2010 by bmittleider

[ricki]

Hi

 

We have just done the same and had the same problems.

 

Here we put in a new server with a new name and set it to the primary domain controller and dhcp etc and shut the old one down.

 

We tried piping paths through dfs and that did not work so policies did not apply so they have been set back to direct to the server.

 

We also had problems with scripts that not all scrips had been changed and this meant that the policies could not find the url and so bugged out and no further policies were applies.

 

The next one we had was the h drive as going through dfs and so no user policies applied.

 

The last thing we had were some machines being too fast for the servers and not picking up group policy so we had to put a registry key in the clients to make them wait for the servers.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"GpNetworkStartTimeoutPolicyValue"=dword:0000003c

 

Richard

[bmittleider]

Applied the registry setting to clients and still no change.

[teejay]

Have you checked the firewall setting on both the client and the server?

[bmittleider]

No, I guess I didn't think to check that since I can browse to the sysvol folder and do most common tasks that require connecting back to the server. What would I be looking for specifically in the firewall that would block GPO?

[ricki]

Applied the registry setting to clients and still no change.

 

How did you apply this setting you did install it manually on one machine to test as you cannot install it with gpo as gpos not being applied.

 

Richard

[teejay]

No, I guess I didn't think to check that since I can browse to the sysvol folder and do most common tasks that require connecting back to the server. What would I be looking for specifically in the firewall that would block GPO?

 

Try turning off the firewall on both client and server temporarily. Its should just work, but if there are no error logs on the client it sounds like it's not even seeing the policy.

[bmittleider]

Applied the registry setting to clients and still no change.

 

How did you apply this setting you did install it manually on one machine to test as you cannot install it with gpo as gpos not being applied.

 

Richard

 

Yes I entered it manually. Rebooted. Logged in, waited a couple minutes just to be on the safe side. Nothing. Rebooted again as sometimes GPO's are just slow. Logged in, waiting again and nothing.

[Slartibartfast]

Were all the forest and domain AD schema updates applied correctly prior to promotion of the first 2008 R2 DC?

 

(also, pet annoyance of mine - there is no such thing as a PDC in an Active Directory environment)

[bmittleider]

Were all the forest and domain AD schema updates applied correctly prior to promotion of the first 2008 R2 DC?

 

(also, pet annoyance of mine - there is no such thing as a PDC in an Active Directory environment)

 

Only one DC. Originally had Server 2008 x64 and was upgraded to R2. Nowhere did I read about having to apply AD schema updates myself. Shouldn't that be done in the upgrade installer? However after the upgrade the domain functional level was raised from 2003 since we don't have any DC on 2003 anymore and only the one on 2008 R2. Did I miss something when raising the domain functional level?

[bmittleider]

teejay: Disabling firewall had no effect.

[teejay]

I think Slarti might be onto something there, you need to run adprep /forestprep and adprep /domainprep before you upgrade. You could try running them now, but make a backup first.

[bmittleider]

I think Slarti might be onto something there, you need to run adprep /forestprep and adprep /domainprep before you upgrade. You could try running them now, but make a backup first.

 

That was done during the normal upgrade process to R2. I had to run those commands during the upgrade I do remember that.

[DrCheese]

That and check that your DNS infrastructure is working properly. Most GP issues are usually down to DNS being screwed somewhere along the line.

Try running DCdiag on your DC and check that there are no errors relating to DNS registration. It won't hurt to run ipconfig /registerdns anyway even if does check out ok.

Check that DHCP is handing out the correct DNS information (if you are using it...) Then check that your clients can correctly resolve the DC's A name and the SRV records that it will have registered.

[teejay]

You could try working your way through Troubleshooting Group Policy Using Event Logs to see if any errors are reported.

[bmittleider]

That and check that your DNS infrastructure is working properly. Most GP issues are usually down to DNS being screwed somewhere along the line.

Try running DCdiag on your DC and check that there are no errors relating to DNS registration. It won't hurt to run ipconfig /registerdns anyway even if does check out ok.

Check that DHCP is handing out the correct DNS information (if you are using it...) Then check that your clients can correctly resolve the DC's A name and the SRV records that it will have registered.

 

DCdiag returned all results as passed. Did the ipconfig /registerdns as well. Rebooted clients an still nothing. Will try the troubleshooting guide posted by teejay next.

[bmittleider]

After checking through the Event Viewer there was only two events that seem odd:

 

Event ID 5314: A fast link was detected. The Estimated bandwidth is 0 kbps. The slow link threshold is 500 kbps.

Event ID 5327: Estimated network bandwidth on one of the connctions: 0 kbps.

[teejay]

Ok, try making a change to a group policy that will require a client reboot, such as assign a piece of software to install. On the client, from the command prompt console, do a gpupdate /force. If it says something along the lines of need to reboot for software installation, then the machine is reading the group policy.

[teejay]

Also, have you done the following on a client:

In order to troubleshoot Group Policy more effectively you can enable verbose logging.

Enable Logging to Userenv.log:

Registry Key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Value: UserenvDebugLevel = REG_DWORD 0x10002

A full log of GPO activities will then be created in %systemroot%\ Debug\UserMode\Userenv.log

 

Set this key to start verbose logging to the Application Event Log:

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics

Set: RunDiagnosticLoggingGroupPolicy = REGDWORD 1

A more comprehensive log of Group Policy will be made to the Event Log

More help can be found on GPO troubleshooting on the following link:

[p858snake]

Have you tied rebuilding/placing a new client onto the network that didn't exist before?

[bmittleider]

Have you tied rebuilding/placing a new client onto the network that didn't exist before?

 

Yes, actually noticed it after joining a brand new laptop into the domain. Also created a bare-metal vm and installed Win7 and Server 2003 R2 (added Client Extentions too) to try.

[bmittleider]

So I have made some progress today. I deleted every GPO that I created on the old server. Then I reset the Default Domain Policy and Default Domain Controller Policy back to their defaults by running dcgpofix /target:both. Be sure to backup the GPOs first. From there I recreated my custom GPOs and they seem to be working, except one. I am trying to map a drive when I am logged in as the Domain Administrator. I have created the item-level targeting to only apply when the SID matches DOMAIN\Administrator but it doesn't seem to map the drive.

[teejay]

So I have made some progress today. I deleted every GPO that I created on the old server. Then I reset the Default Domain Policy and Default Domain Controller Policy back to their defaults by running dcgpofix /target:both. Be sure to backup the GPOs first. From there I recreated my custom GPOs and they seem to be working, except one. I am trying to map a drive when I am logged in as the Domain Administrator. I have created the item-level targeting to only apply when the SID matches DOMAIN\Administrator but it doesn't seem to map the drive.

That's great news :-)

Is UAC enabled on the PC as this can cause problems when Domain Admins log in with mapped drives. Try it as a normal user, or disable UAC.