Group Policy not applying .. well .. actually .. [read on]

soveryapt · September 21, 2011

Right, ok so an interesting one that I've been trying to trouble shoot.

We changed school status / class names / staff / pupils over the summer so I took the opportunity to streamline the GPOs on my network as such. I had a lot of legacy things in place still from when I took over the network (and it's 15 min / user setup time! I know .. madness!).

Anyway, random things are happening. There are a couple of scenarios through the school:

New Member of Staff + Freshly Imaged Machine = everything deploys as it should do
New Member of Staff + Used machine but same image = things mainly deploy as they should do, but every so often they get a random drive crop up
Old Member of Staff + Freshly Imaged or Used Image Machine = sometimes they get the new settings, sometimes they get the old settings
The same set of things can be applied for the new students too

So, I've tried forcing a GPUpdate on the various machines, to no avail, hence the trying a freshly imaged machine with an old user account, but I can't for the life of me figure out what's going on.

There used to be a number of Logon / Startup Scripts used, but I've stripped these right back, in fact, pretty much the only script to run now is check the AV is installed (using a script provided by county technicians) and also check that the registration file is in place for TextEase as it doesn't always deploy correctly. There is then a couple of scripts that run to set Espresso Icons, Internet Icons (following the EU ruling for MS to remove all shortcuts for IE!) and a shortcut to our helpdesk.

At logoff, the only thing to be run now is a force delete of all mapped drives hoping that by doing so that it would force the system to pick up the new settings.

The only other thing to run at logon is the PC-Client for PaperCut.

Now, to check things further I logged onto the servers with my own credentials (which I do normally anyway to avoid using the admin account unless I really need to as I've locked myself down slightly too). This is where it gets a bit more interesting and leads me to a couple of conclusions:

If I log onto server-001 I get everything as I should get, new drive maps (despite the fact I've logged on previously with old drive maps), shortcuts, printers, etc. This is the server I edited the GPO settings on.

If I log onto server-002 then I get all the old stuff in terms of drives, and I only get 1 of the shortcuts (Espresso) that was there previously. Printers deploy, but on the old settings.

Now, this makes me think that somewhere along the lines, my SYSVOL has gone a bit funny, but I'm a bit at a loss on how to reset it sensibly. I've found a couple of howtos on MS technet, but wanted to see if there was something else that could be done or an easier solution instead of going through the whole SYSVOL reset procedure on a live network.

Many thanks in advance

Andy

sonofsanta · September 21, 2011

Daft question, but... it's not just cached copies of old roaming profiles in Documents & Settings, is it? Would explain why newly imaged machines are fine (no cache) but otherwise identical, just older machines, have problems (old settings cached).

Might be worth finding a profile that has a problem on a certain machine, clearing both profile and machine down completely, and seeing if the problem persists. Or if that doesn't work, clear someone's profile down, remove any cached copies from a newly imaged machine and get them to log on that one, and see if it rebuilds correctly on that. Worth a punt, anyway!

soveryapt · September 21, 2011

Daft question, but... it's not just cached copies of old roaming profiles in Documents & Settings, is it? Would explain why newly imaged machines are fine (no cache) but otherwise identical, just older machines, have problems (old settings cached).

Might be worth finding a profile that has a problem on a certain machine, clearing both profile and machine down completely, and seeing if the problem persists. Or if that doesn't work, clear someone's profile down, remove any cached copies from a newly imaged machine and get them to log on that one, and see if it rebuilds correctly on that. Worth a punt, anyway!

It's quite sporadic unfortunately. As in sometimes they can log onto a machine and it's fine, others it's not.

I'm just running dcdiag /a /c /q to flag up any errors and it looks like there may be some issues with one of my servers actually, so going to take a look down that route ..

sonofsanta · September 21, 2011

It's quite sporadic unfortunately. As in sometimes they can log onto a machine and it's fine, others it's not.

I'm just running dcdiag /a /c /q to flag up any errors and it looks like there may be some issues with one of my servers actually, so going to take a look down that route ..

Don't forget to take a ball of string with you, so you can find your way back out of the maze in three days time... good luck!

soveryapt · September 21, 2011

DC Diag Reports from Various Servers:

Server 1

C:\Users\administrator.BROADFIELD>dcdiag /a /c /q

        [bSS-SERVER-002] No security related replication errors were found on

        this DC!  To target the connection to a specific source DC use

        /ReplSource:.

        The event log File Replication Service on server

        BSS-SERVER-002.Broadfield.School could not be queried, error 0x6ba

        "The RPC server is unavailable."

        ......................... BSS-SERVER-002 failed test FrsEvent

        The event log Directory Service on server

        BSS-SERVER-002.Broadfield.School could not be queried, error 0x6ba

        "The RPC server is unavailable."

        ......................... BSS-SERVER-002 failed test KccEvent

        ** Did not run Outbound Secure Channels test because /testdomain: was

        not entered

        The event log System on server BSS-SERVER-002.Broadfield.School could

        not be queried, error 0x6ba "The RPC server is unavailable."

        ......................... BSS-SERVER-002 failed test SystemLog

        LDAP Error 0x5e (94) - No result present in message.

        ......................... BSS-SERVER-002 failed test

        VerifyEnterpriseReferences

        [bSS-SERVER-001] No security related replication errors were found on

        this DC!  To target the connection to a specific source DC use

        /ReplSource:.

        ** Did not run Outbound Secure Channels test because /testdomain: was

        not entered

        LDAP Error 0x5e (94) - No result present in message.

        ......................... BSS-SERVER-001 failed test

        VerifyEnterpriseReferences

                 Invalid service type: DNS on BSS-SERVER-002, current value

                 WIN32_OWN_PROCESS, expected value WIN32_OWN_PROCESS

        Test results for domain controllers:



           DC: BSS-SERVER-001.Broadfield.School

           Domain: Broadfield.School





              TEST: Forwarders/Root hints (Forw)

                 Error: All forwarders in the forwarder list are invalid.





           DC: BSS-SERVER-002.Broadfield.School

           Domain: Broadfield.School





              TEST: Basic (Basc)

                 Error: DNS service is not running



              TEST: Forwarders/Root hints (Forw)

                 Error: All forwarders in the forwarder list are invalid.

                 Error: Both root hints and forwarders are not configured or

                 broken. Please make sure at least one of them works.



        Summary of DNS test results:



                                           Auth Basc Forw Del  Dyn  RReg Ext

           _________________________________________________________________

           Domain: Broadfield.School

              BSS-SERVER-001               PASS WARN FAIL PASS WARN PASS n/a

              BSS-SERVER-002               PASS FAIL FAIL PASS WARN PASS n/a



        ......................... Broadfield.School failed test DNS

Server 2

C:\Users\Administrator.BROADFIELD>dcdiag /a /c /q

        [bSS-SERVER-002] No security related replication errors were found on

        this DC!  To target the connection to a specific source DC use

        /ReplSource:.

        ** Did not run Outbound Secure Channels test because /testdomain: was

        not entered

        LDAP Error 0x5e (94) - No result present in message.

        ......................... BSS-SERVER-002 failed test

        VerifyEnterpriseReferences

        [bSS-SERVER-001] No security related replication errors were found on

        this DC!  To target the connection to a specific source DC use

        /ReplSource:.

        The event log File Replication Service on server

        BSS-SERVER-001.Broadfield.School could not be queried, error 0x6ba

        "The RPC server is unavailable."

        ......................... BSS-SERVER-001 failed test FrsEvent

        The event log Directory Service on server

        BSS-SERVER-001.Broadfield.School could not be queried, error 0x6ba

        "The RPC server is unavailable."

        ......................... BSS-SERVER-001 failed test KccEvent

        ** Did not run Outbound Secure Channels test because /testdomain: was

        not entered

        The event log System on server BSS-SERVER-001.Broadfield.School could

        not be queried, error 0x6ba "The RPC server is unavailable."

        ......................... BSS-SERVER-001 failed test SystemLog

        LDAP Error 0x5e (94) - No result present in message.

        ......................... BSS-SERVER-001 failed test

        VerifyEnterpriseReferences

                 Invalid service type: DNS on BSS-SERVER-002, current value

                 WIN32_OWN_PROCESS, expected value WIN32_OWN_PROCESS

        Test results for domain controllers:



           DC: BSS-SERVER-002.Broadfield.School

           Domain: Broadfield.School





              TEST: Basic (Basc)

                 Error: DNS service is not running



              TEST: Forwarders/Root hints (Forw)

                 Error: All forwarders in the forwarder list are invalid.

                 Error: Both root hints and forwarders are not configured or

                 broken. Please make sure at least one of them works.





           DC: BSS-SERVER-001.Broadfield.School

           Domain: Broadfield.School





              TEST: Forwarders/Root hints (Forw)

                 Error: All forwarders in the forwarder list are invalid.



        Summary of DNS test results:



                                           Auth Basc Forw Del  Dyn  RReg Ext

           _________________________________________________________________

           Domain: Broadfield.School

              BSS-SERVER-002               PASS FAIL FAIL PASS WARN PASS n/a

              BSS-SERVER-001               PASS WARN FAIL PASS WARN PASS n/a



        ......................... Broadfield.School failed test DNS

In case it helps anyone with suggestions ..

soveryapt · September 21, 2011

Don't forget to take a ball of string with you, so you can find your way back out of the maze in three days time... good luck!

lol .. indeed!!

jinnantonnixx · September 21, 2011

I'm in a casserole of nonsense with some GPO problems of my own....

I've got some utterly ridiculous things going on here...

But....

Have you tried running a GPO simulation to see what should be happening?

As part of my world of hurt here, I found that switches with spanning tree frequently cause problems with GPOs, scripts and such.

Try switching off spanning tree (if your switch doesn't use redundant uplinks), or disable it for client ports (enable PORTFAST)

Just Google GPO spanning tree.

soveryapt · September 21, 2011

I'm in a casserole of nonsense with some GPO problems of my own....

I've got some things which simply don't make sense...

Have you tried running a GPO simulation to see what should be happening?

As part of my world of hurt here, I found that switches with spanning tree frequently cause problems with GPOs, scripts and such.
Try switching off spanning tree (if your switch doesn't use redundant uplinks), or disable it for client ports (enable PORTFAST)

Just Google GPO spanning tree.

I will take a look at that. Thanks

jinnantonnixx · September 21, 2011

My simulation for a user on a machine says everything should be wonderful, but the whole bank of machines simply aren't doing what they should be..... it's utterly infuriating....

If I fix it, I'll post the solution, even if it's a different problem....

sonofsanta · September 21, 2011

It's worth bearing in mind that GPOs can just be retarded sometimes. I had one problem once with IE Security Zones where the solution was already implemented in the Basic User Config GPO, but wasn't applying; adding it in to the separate Staff and Student configs one node down fixed the problem. Never did work out why the domain stopped listening to that first GPO...

@apt - the DNS entries look suspect... I'd run the command myself to check but my DC is running through adprep at the moment, so I dont' want to do anything to upset it...!

jinnantonnixx · September 21, 2011

Ah, mixing IE settings in different GPOs is widely known to end in cataclysms. I've seen that a few times.

jinnantonnixx · September 21, 2011

By the way, you have the synchronous enabled & asynchronus disabled on the machine side policy processing GPO?

Don't forget this little beauty:

Computer Settings

Administrative Templates

System

Logon

Always wait for the network at computer startup and logon - Enabled

sonofsanta · September 21, 2011

By the way, you have the synchronous enabled & asynchronus disabled on the machine side policy processing GPO?

Don't forget this little beauty:

Computer Settings
Administrative Templates
System
Logon
Always wait for the network at computer startup and logon - Enabled

On a similar note, the following reg key imported helps if you're getting Event ID 1054 in your logs, and possibly also 5719

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"DisableDHCPMediaSense"=dword:00000001

Try updating your network drivers as well as sometimes outdated drivers stop some of our PCs from correctly picking up GPOs (which normally shows as Event ID 5719).

jinnantonnixx · September 21, 2011

aha!

This might be worth trying - it's shown something odd on my system.

Run GPO simulation against a real user and a real machine (not just the OU/container), and go through the items in the 'settings' tab.

I've seen a clash of policies; the 'winning policy' is not the one I expected to see setting the logon scipts which are causing the problems.

I've got a mixed XP and 7 system, I think I'll put a WMI filter on my XP policies to make sure they don't shoulder my 7 policies out of the room.

Edit: Discovered the WMI filter is already in place ('Pre-vista'). However, the policy is winning over my 7 policy (with a Windows 7 WMI filter). This shouldn't be happening! Aaargh!

Edited September 21, 2011 by jinnantonnixx

soveryapt · September 21, 2011

My simulation for a user on a machine says everything should be wonderful, but the whole bank of machines simply aren't doing what they should be..... it's utterly infuriating....

If I fix it, I'll post the solution, even if it's a different problem....

I know, I can run various simulations and get a different response each time, even if it's the same one.

I have a horrible feeling that my SYSVOL have gone a bit iffy and that instead of sharing out on DFS correctly, the computers are picking and choosing the logins.

In response to SOS: I've just tried deleting profiles on problematic machines and then getting the member of staff to log back on again. The drives and stuff deployed perfectly, however .. once everything had loaded, Window (7 Pro 32Bit) decided that actually they only had a temporary logon .. however, a reboot of the machine and va va voom, all back and working properly.

So, I'm going to attempt deleting all the profiles from the network other than the public one, so if anyone has a script that would do this .. lol ..

soveryapt · September 21, 2011

Meh .. RSOP Testing here I come me thinks as it worked for the staff member but not the students! GAH! At least I can stop deleting profiles for now .. lol ..

jinnantonnixx · September 22, 2011

I think I found it.

Group policy doesn't run user logon scripts (amongst other things) if it detects a 'slow network'. Now, for some reason (another problem), the workstations are, at random, deciding that they live on a slow network. This means we seeing odd things and random failures of logon scripts

To fix it,

Computer Config>AdminTemplates>System>GroupPolicy>Scripts Policy Processing:Enabled

Tick "allow processing across a slow network", "do not apply in background" and "process even if not changed" (to make sure that any user change gets wiped out)

So far so good...

TheMan100 · September 22, 2011

You could also set the 'Slow Link Detection' (something along the lines of that) GPO to 0, so it won't recognise a slow connection at all.

soveryapt · September 22, 2011

Well, having fully reset the SysVol folders, and rewritten a basic GPO set for the school, everything finally seems to be coming together.

I figured the system has been patched enough over the years from what I inherited. Need's a total rebuild at somepoint from the ground up, but there we go.

Thanks for all the helpful suggestions and I've applied a couple of the things (like the running the GPO and flushing out stuff so that hopefully it keeps on top of things).

Early in tomorrow to make sure it's all working as it should, and only just leaving tonight!! Yikes! At least I got a lunch today! lol ..

Group Policy not applying .. well .. actually .. [read on]

Recommended Posts

soveryapt

sonofsanta

soveryapt

sonofsanta

soveryapt

soveryapt

jinnantonnixx

soveryapt

jinnantonnixx

sonofsanta

jinnantonnixx

jinnantonnixx

sonofsanta

jinnantonnixx

soveryapt

soveryapt

jinnantonnixx

TheMan100

soveryapt

Create an account or sign in to comment

Create an account

Sign in

Recent Threads

My Fluke LinkRunner has a fault...

iOS 27 BYOD and Smoothwall web filtering - Connectivity Assist causing issues?

3rd Party Warranty on Existing Panels

Home

Forums

What's New