Room not following policies correctly

[localzuk]

I have recently done a change to the way pupil accounts are set up.

 

They used to be a set of folders which were redirected to and local profiles only. Now I have a mandatory profile which they all use.

 

This works 100% fine on every computer in our school except one of our IT suites.

 

For some reason this room is not applying the (duplicate of the old policy, without the redirection settings) group policy. Why would this be?

 

I have tried deleting local profiles from the computers but this makes no difference.

 

Cheers

Tony

[Quackers]

They have not got loopback policy enabled have they?

[Geoff]

Run the GPMC with modelling and results wizards. Compare and contrast. Also follow up any errors the reports find directly.

 

Run netdiag on the clients.

[timbo343]

you could always try re-joining the computers back to the domain. Its a long shot tho

[srochford]

have you looked in the event log on the machines? We sometimes find that machines fail to apply policies.

 

Look in the application log for event 1704 - "Security policy in the Group policy objects has been applied successfully." You should see about 1 per day; if they're not there then you'll probably find you've got event 1202 showing a failure to apply. The MS article http://support.microsoft.com/kb/324383 gives lots of info on this but a quick thing to try is repairing the security database - at a prompt on the machine run

esentutl /p /o c:\WINDOWS\security\Database\secedit.sdb

and then force an update:

gpupdate /force

- you'll probably need to reboot and then check the event logs again.

 

If it is a problem with the secedit database then you can fix it on a batch of machines by using psexec (from http://www.microsoft.com/technet/sysinternals/default.mspx) - just write a batch file with a series of

 

psexec \\computer1 esentutl /p /o c:\WINDOWS\security\Database\secedit.sdb

psexec \\computer2 esentutl /p /o c:\WINDOWS\security\Database\secedit.sdb

psexec \\computer3 esentutl /p /o c:\WINDOWS\security\Database\secedit.sdb

 

etc.

 

Steve

[Ric_]

They aren't just looking at cached copies of the old profiles are they? Run delprof over them.

[localzuk]

Well it isn't the security database and the policies are applying according to the event viewer.

 

It also isn't the profiles as I have delproffed them all.

 

I have also tried re-joining to the domain.

 

The last thing for me to do is build a new image and reimage the lot of em I suppose.

[Geoff]

Can you post the output from netdiag when run from one of the affected clients?

[tscnmuk]

That's probabaly a little extream but I have been there and done that myself. The most frustrating thing in the world when your policies aren't applying correctly but there appears to be no reason for it. Good luck and I hope you find the solution before having to reimage them all.

 

Tom

[localzuk]

Netdiag won't run - 'The procedure entry point DnsGetPrimaryDomainName_UTF8 could not be located ini the dynamic library DNSAPI.dll'

 

I think there is something wrong with WMI on the machines, amongst other things...

[Geoff]

Your attempting to use the W2k version of Netdiag on XP/W2K3. Don't do that. It doesn't work. Use the version from the XP support tools or the 2k3 server cd. Or just download it from Microsoft.

[localzuk]

I have installed the support tools for XP and it is not there. I'll have a look on the 2k3 cd.

[Geoff]

Here's a download URL if you haven't found your copy yet.

 

http://www.microsoft.com/downloads/details.aspx?familyid=49AE8576-9BB9-4126-9761-BA8011FABF38&displaylang=en

[localzuk]

Ok, tried with that version and get a similar error 'The procedure entry point DnsNetworkInformation_CreateFromFAZ cold not be located in the dynamic link library DNSAPI.dll' - this is the one from the 2k3 cd.

 

The XP Support tools pack didn't install netdiag... (Unless I was just installing an update or something?)

[Geoff]

You can't run the W2k3 version of Netdiag on XP either. You need the XP version. It is contained in the download I posted however it gets installed in "C:\Program Files\Support Tools\" This folder is not in your path. Either CD into the folder at the dos prompt. Or copy the netdiag.exe program into C:\Windows\system32

[localzuk]

Right, got it. The typical install doesn't install it. A complete install does.

 

The output is:

 

......................................

   Computer Name: LIBRARY-18
   DNS Host Name: LIBRARY-18.sch4290.somerset.gov.uk
   System info : Windows 2000 Professional (Build 2600)
   Processor : x86 Family 15 Model 4 Stepping 1, GenuineIntel
   List of installed hotfixes : 
       Q147222


Netcard queries test . . . . . . . : Passed
   GetStats failed for 'Infrared Port'. [ERROR_NOT_SUPPORTED]



Per interface results:

   Adapter : Local Area Connection

       Netcard queries test . . . : Passed

       Host Name. . . . . . . . . : LIBRARY-18.sch4290.somerset.sch.uk
       IP Address . . . . . . . . : 10.5.140.144
       Subnet Mask. . . . . . . . : 255.255.252.0
       Default Gateway. . . . . . : 10.5.143.254
       Dns Servers. . . . . . . . : 10.5.143.230


       AutoConfiguration results. . . . . . : Passed

       Default gateway test . . . : Passed

       NetBT name test. . . . . . : Passed

       WINS service test. . . . . : Skipped
           There are no WINS servers configured for this interface.


Global results:


Domain membership test . . . . . . : Passed


NetBT transports test. . . . . . . : Passed
   List of NetBt transports currently configured:
       NetBT_Tcpip_{75993053-E2A9-4727-9A76-D48B4392CABC}
   1 NetBt transport currently configured.


Autonet address test . . . . . . . : Passed


IP loopback ping test. . . . . . . : Passed


Default gateway test . . . . . . . : Passed


NetBT name test. . . . . . . . . . : Passed


Winsock test . . . . . . . . . . . : Passed


DNS test . . . . . . . . . . . . . : Passed


Redir and Browser test . . . . . . : Passed
   List of NetBt transports currently bound to the Redir
       NetBT_Tcpip_{75993053-E2A9-4727-9A76-D48B4392CABC}
   The redir is bound to 1 NetBt transport.

   List of NetBt transports currently bound to the browser
       NetBT_Tcpip_{75993053-E2A9-4727-9A76-D48B4392CABC}
   The browser is bound to 1 NetBt transport.


DC discovery test. . . . . . . . . : Passed


DC list test . . . . . . . . . . . : Passed


Trust relationship test. . . . . . : Passed
   Secure channel for domain 'SCH4290' is to '\\app1.sch4290.somerset.gov.uk'.


Kerberos test. . . . . . . . . . . : Failed
       [FATAL] Kerberos does not have a ticket for host/LIBRARY-18.sch4290.somerset.gov.uk.


LDAP test. . . . . . . . . . . . . : Passed


Bindings test. . . . . . . . . . . : Passed


WAN configuration test . . . . . . : Skipped
   No active remote access connections.


Modem diagnostics test . . . . . . : Passed

IP Security test . . . . . . . . . : Passed
   Service status  is: Started
   Service startup is: Automatic
   IPSec service is available, but no policy is assigned or active
   Note: run "ipseccmd /?" for more detailed information


The command completed successfully

[Geoff]

Kerberos has failed. Obvious reason would be that the systems time is out of sync with the DC. Can you check that?

[localzuk]

Exactly 1 minute out of sync. Not enough to cause issues. According to the more verbose report from netdiag the kerberos test returns:

 

Kerberos test. . . . . . . . . . . : Failed
   Cached Tickets:
   Server: krbtgt/SCH4290.SOMERSET.GOV.UK
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
   Server: krbtgt/SCH4290.SOMERSET.GOV.UK
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
   Server: LDAP/app1.sch4290.somerset.gov.uk/sch4290.somerset.gov.uk
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
   Server: ldap/vm1.sch4290.somerset.gov.uk
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
   Server: LDAP/app1.sch4290.somerset.gov.uk
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
   Server: cifs/app1.sch4290.somerset.gov.uk
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
   Server: cifs/sql1
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
   Server: cifs/ad1.sch4290.somerset.gov.uk
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
   Server: cifs/vm1.sch4290.somerset.gov.uk
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
   Server: cifs/APP1
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
   Server: ldap/AD1.sch4290.somerset.gov.uk/sch4290.somerset.gov.uk
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
   Server: LDAP/AD1.sch4290.somerset.gov.uk
       End Time: 1/23/2007 0:22:54
       Renew Time: 1/29/2007 14:22:54
       [FATAL] Kerberos does not have a ticket for host/LIBRARY-18.sch4290.somerset.gov.uk.

 

It has kerberos tickets for the servers, not for itself?

[Geoff]

Can you look through the security event log for any failed audit events?

[localzuk]

Only a couple of users failing to log in in there (along with hundreds of success audit events).

[Geoff]

what does

klist tickets

show?

[localzuk]

Nothing, command not found.

 

I have set off a re-image now anyway, as it has allowed me to remove a load of the old junk that was on the machines and tidy things up slightly. Thanks for the help though.