GPO Permission Denied

[beany1]

Hi,

 

Started up the PC that I setup with the reg key in the Test OU this morning - Access is denied on the GPO. Did a Gpupdate /force same message. Anything further I could try? Could it be something hardware related or something specific to these PCs? I'm just confused to how it can be affecting these 33 PCs but not the 45 laptops that are also running Windows 7, the same GPOs and the same software?

 

Thanks

[sukh]

Hi

 

I'm just on my way to work (on the train) can you check the GUID of two machines that have the issue?

 

At this point in time I don't know if you have the but if these effected PC's are not being used, can you do a fresh install on one, I.e use the Win 7 dvd and install manually? While we continue to troubleshoot?

 

If you do decide to rebuild manually, please delete the computer account for that PC first.

 

Let me know your thoughts?

 

Thanks

Sukh

[beany1]

Hi,

 

unfortunately I don't have any windows media for the PCs instead its using the recovery partition as the machines came with Windows 7 pro pre-installed will this be ok? As for checking the GUID how do I do this? sorry haven't got a clue!

 

Thanks

[sukh]

Hi

 

Leave the GUID for now.

 

Before you rebuild a machine, can you clarify/confirm the following.

 

1. Did you build a image yourself for these problem machines?

2. The recovery partition is as when you received the machines from the manufacturer?

3. When you build the machines, you use your own image?

4. How do you build the machines? Deployment method? Image creation?

 

Thanks

Sukh

[beany1]

Hi,

 

Yeh I setup a PC using the installation of Windows provided. Installed software etc. Then used sysprep and cloned this setup onto the other PCs which are all identical. used clonezilla to copy the image. deployed over a switch and a separate network.

 

But I also did the exact same process for the laptops and no matter what I do I can't make them repeat the same GPO issues as the PCs. However the laptops were built with a clean install of Windows 7 pro.

 

Thanks

[sukh]

Hi

 

When the laptop were purchases, did they come with a recovey partition and if so did you wipe this then installed a clean version of Windows 7, if so how? where did you get the media from?

 

The PC's were provided by the manufacturer and you performed a sysprep on these PC's.

 

What licenses did you use for the laptop deployment and for the PC's?

 

Thanks

Sukh

[beany1]

Hi,

 

The laptops came with Windows 7 Home premium or something, we purchased the schools windows 7 professional upgrade which is a full install cd but requires an existing licence so it was a full clean install deleting the existing partitions. l have a MAK code from the separate purchase of 7 professional for the laptops which is identical.

 

I setup 1 pc, installed software etc. then sysprep and cloned it on to the other machines. The pcs all have seperate licenses so I used slmgr.vbs command line to change the license key to the corresponding licence. All activated.

 

Thanks

[sukh]

Hi

 

Can you as a test, rebuild one the the PC's from the recovery partition and join to the domain. Before rebuilding, can you ensure the computer account has been deleted from AD?

 

After this, if we still have an issue, I will send you information on more logs which I'd like you to collect from two problematic PC's.

 

Let me know how you are going to proceed?

 

Thanks

Sukh

[beany1]

Hi,

 

I've done that, deleted account from AD. I've restored windows from the partition, and joined the domain again. So far so good, however after making the changes yesturday it also worked for a while. So I have restarted and gpupdate /force a couple of times with it still working and receiving the latest GPOs, ill try it again in a while. At the moment I've just left the computer in the default "Computer" OU so its only receiving the Default policy.

 

Thanks

[sukh]

Hi

 

Thanks for the update.

 

Let me know how it goes.

 

Sukh

[beany1]

Hi,

 

Annoyingly the clean build of the PC works. I've moved it into that test OU so its receiving the Default policy, the Win7 policy and the Test OU policy and all are received fine so I'm unsure how to go ahead now, could I some how diagnose by comparing?? Or shall I just install the software I want on this and clone it and start again?

 

Thanks for all the help!

[sukh]

Hi

 

Can you move the PC which you have just built to the same OU as the other problematic computers and ensure that the policies which are being applied are the ones that you intend to apply in the end.

 

There may have been an issue with your image which may have caused this but I can't comment on this as I don't have the history.

 

If you can, do the above test and let me know.

 

Thanks

Sukh

[beany1]

Hi,

 

Moved the PC into the OU and gpupdate /force a lot of times but it won't break so its looking like an error with the image...

 

Gonna finish setting this PC up and clone and see what happens with GPOs.

 

Is there anything that springs to mind that could of happend to the PC to make the setup not allow GPO updates? Firewall is disabled, DNS / DHCP settings are received OK, new users can log in from AD, and software is installed by MSI from GP.

 

Any how, thanks for all your help

[sukh]

Hi

 

My only assumption is when the source machine was imaged, the sysprep was not run correctly or there may have been some sort of corruption in the process.

 

Finish preparing your machine for imaging and run sysprep. After you have finished, deploy the image to one other machine and test with all GPO's. If all good, then rollout to remaining PC's.

 

Let me know how you get along.

 

Thanks

Sukh