First logon doesn't load GP...

[CHiLL]

Our new Windows 7 computers seem to have a weird problem;

 

We built up a working Windows 7 image. When we put that image onto the other computers, it all works fine. We change the name, configure one or two other little changes and reboot. Then we join the domain, and turn it off. Move the computer account into the correct GPO, and boot the PC up again.

 

When the PC comes back on, and we log on with any working account, it doesn't load the user group policy. Logging off and back on immediately, and it works. It then works perfectly, seemingly forever more! It's only that first time we log on.

 

EvenViewer displays:

 

The description for Event ID 1085 from source Microsoft-Windows-GroupPolicy cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.

 

If the event originated on another computer, the display information had to be saved with the event.

 

The following information was included with the event:

 

1

3961

1

2075

1003

Cannot complete this function.

\\SIXTHFORM.Christ.local

Folder Redirection

{25537BA6-77A8-11D2-9B6C-0000F8080861}

 

The handle is invalid

 

I am to run a gpresult on the PC when I have reloaded the ghost image.

[irsprint84]

Did you do any windows update before the imaging i.e. did you let them isntall first?

[CHiLL]

No, we didn't.

[ricki]

Have a look here

 

Event ID 1085 Source Userenv

 

I have seen it when folder redirection is not working well.

 

Richard

[CHiLL]

Have a look here

 

Event ID 1085 Source Userenv

 

I have seen it when folder redirection is not working well.

 

Richard

But why is it the first time you log on only? :S

[strawberry]

Some Gp's are only picked up at logon so wont show effect untill the second logon... Does that seem plausible for your policies?

[CHiLL]

Well, the whole profile is scrubbed at log off. The policies are applied as follows:

 

Staff:

Default Domain Policy > Workstation policy > Staff policy

 

Students:

Default Domain Policy > Workstation policy > Students policy

 

The default domain policy has barely been touched, so isn't really doing anything.

[featured_spectre]

Have a script that forces GP Update before anything else kicks in?

[ricki]

HI

 

My guess is that something in the group policies is causing a delay and other policies then start being applied and the problem one times out. I used to have it with proxy settings for ie. I was using a old adm that caused a delay and it would not apply first time. I have also seen it where a script or a policy in gpo were looking at the wrong location that would time out. Dns problems can also cause delays and so can dfs.

 

I am not sure but the first time you get a profile it sets up a lot of things like you browser settings and if this is getting stuck on something. It could be cuasing the problem.

 

The list can be endless.

[ricki]

HI

 

I have an idea. Would you be willing to do some playing.

 

Could you create a test user and place then in a new ou with blocked inheritance.

 

Place a test computer in a test ou with blocked inheritance and then link one policy at a time and between tests delete the profile.

 

If the tests start to apply it might be a policy that got setting incorrect or corrupt.

 

Also does the computer wait for the domain before starting it can be set in group policy.

 

My network is not as fast as some of my newest machines and I have to put a delay in and tell them to wait for the domain.

 

Richard

[m25man]

Do you have a Reverse DNS Zone?

This issue is commonly caused by reverse DNS pollution.

 

When you image the PC the Imaging Process will assign a netbios name to an IP address and register this in DHCP/DNS and more importantly create a Reverse entry if you have an RDNS zone.

Eg - minint-123456.mydomain.local = 192.168.1.123 and 192.168.1.123 = minint-123456.mydomain.local

 

Once the system has been renamed and joined to the domain proper, it will become PC0123.mydomain.local = 192.168.1.123

 

You often will end up with two different netbiosnames with the same IP address.

 

The inconsistency in the DNS/RDNS zones and machine names causes the GP to fail.

This also applies to any other application the relies on reverse lookups in DNS (Sophos is commonly crippled by this phenomena)

 

Check your DNS/RDNS Zones carefully and manually remove any erroneous or duplicated workstation records especially if you have been imaging PC's as it could take 7 days before the DNS and DHCP records fully reconcile which is when these strange issues suddenly disappear!

 

Reverse DNS Zones are not essential for Windows DNS to work but if it exists it has to be right.

 

This is a routine part of our Preventative Maintenence routines on all of the various systems we support.