GPO Problem

[Techdw]

Hi All.

 

For some reason Yesterday we started having major GPO problems. First I noticed that the PC were pulling over all the old printers from the old server, even though they are setup using GP on the new server, then

today I am getting this message when doing a GPUpdate and now the GPO are not pulling over for clients.

Servers -Windows 2008 R2

Clients Widows 7

 

This isthe error

 

C:\Users\Administrator.******>gpupdate /force

Updating Policy...

 

User policy could not be updated successfully. The following errors were encount

ered:

 

The processing of Group Policy failed. Windows attempted to read the file \\DOMAIN NAME.local\sysvol\*******.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\g

pt.ini from a domain controller and was not successful. Group Policy settings ma

y not be applied until this event is resolved. This issue may be transient and c

ould be caused by one or more of the following:

a) Name Resolution/Network Connectivity to the current domain controller.

b) File Replication Service Latency (a file created on another domain controller

has not replicated to the current domain controller).

c) The Distributed File System (DFS) client has been disabled.

Computer policy could not be updated successfully. The following errors were enc

ountered:

 

The processing of Group Policy failed. Windows attempted to read the file \\DOMAIN NAME.local\sysvol\*****.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\g

pt.ini from a domain controller and was not successful. Group Policy settings ma

y not be applied until this event is resolved. This issue may be transient and c

ould be caused by one or more of the following:

a) Name Resolution/Network Connectivity to the current domain controller.

b) File Replication Service Latency (a file created on another domain controller

has not replicated to the current domain controller).

c) The Distributed File System (DFS) client has been disabled.

 

To diagnose the failure, review the event log or run GPRESULT /H GPReport.html f

rom the command line to access information about Group Policy results.

 

When I run the gpreport it flags up a red X for:

 

 

Component Name Status Last Process Time

Group Policy Infrastructure Failed 9/9/2011 8:31:53 AM

Group Policy Infrastructure failed due to the error listed below.

 

The system cannot find the path specified.

 

Note: Due to the GP Core failure, none of the other Group Policy components processed their policy. Consequently, status information for the other components is not available.

 

Additional information may have been logged. Review the Policy Events tab in the console or the application event log for events between 9/9/2011 8:31:52 AM and 9/9/2011 8:31:53 AM.

 

 

Any Help would be great!

Edited September 9, 2011 by Techdw

[Techdw]

I have rebooted all DC's, Checked all services are running. I can find the folder {31B2F340-016D-11D2-945F-00C04FB984F9}

GPO are not pulling over to client machines at all.

[iMash]

Are there any error events for replication on any of the domain controllers (something along the lines of replication failed/paused)?

 

Can you ping all of the domain controllers (by FQDN) from the client/clients in question?

[Techdw]

Can ping all servers.

 

In Event Vwr, I have this error

 

The DFS Replication service failed to contact domain controller to access configuration information. Replication is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.

 

Additional Information:

Error: 160 (One or more arguments are not correct.)

 

but nothing else in in there. We havent used DFS

Edited September 9, 2011 by Techdw

[Techdw]

Also this

 

The File Replication Service is no longer preventing the computer DC01 from becoming a domain controller. The system volume has been successfully initialized and the Netlogon service has been notified that the system volume is now ready to be shared as SYSVOL.

 

Type "net share" to check for the SYSVOL share.

[iMash]

In Event Vwr, I have this error

 

The DFS Replication service failed to contact domain controller to access configuration information. Replication is stopped. The service will try again during the next configuration polling cycle, which will occur in 60 minutes. This event can be caused by TCP/IP connectivity, firewall, Active Directory Domain Services, or DNS issues.

 

Additional Information:

Error: 160 (One or more arguments are not correct.)

 

I would probably be inclined to start looking at DNS for a solution.

 

Active directory uses file replication itself as a way of replicating changes to the directory and to the SYSVOL shares. If replication is failing then the chances are that policies will not be updated on all other servers when changes occur.

 

take a look at the technet site here for some ways to troubleshoot the first error you posted.

 

In particular from the technet page, try nslookup on "yourdomain.local" and check that it returns an IP address of a domain controller.

 

 

The File Replication Service is no longer preventing the computer DC01 from becoming a domain controller. The system volume has been successfully initialized and the Netlogon service has been notified that the system volume is now ready to be shared as SYSVOL.

 

Type "net share" to check for the SYSVOL share.

 

This event usually appears as a warning (if I remember correctly), and usually isn't something to worry about. Its just information to say that the domain controller is now up and running.

[Techdw]

OK after some looking around {31B2F340-016D-11D2-945F-00C04FB984F9} is the '' Default Domain Policy '' GPO and I cant access it, if I edit it it says '' Failed to open the GPO. You may not have appropriate right.. Details. The system cannot find the Path specified.

[Techdw]

Just backed up {31B2F340-016D-11D2-945F-00C04FB984F9} which was the domain policy and all looks like its working.

[iMash]

Just backed up {31B2F340-016D-11D2-945F-00C04FB984F9} which was the domain policy and all looks like its working.

 

Good good. Glad its all working. Keep an eye on any errors within DSFRS (eventvwr) though as I would hazard a guess that the error originated from there somewhere.