User Group Policies not applying

[jlucas]

Hi everyone

 

Having a problem with Group Policy on some of our curriculum machines at the moment.

When anyone logs on (administrator/teacher/student) the User side of Group Policy seems to fail.

 

It doesn't seem to be happening to all machines or a specific set of users.

 

When logging onto an affected machine it takes around 10 minutes to complete the log on (usually about 20seconds), and the user will have no proxy settings or restrictions.

 

Group Policy preferences seem to be applying as they were getting network drives.

 

The client log files don't seem particularly helpful, in Application I get:

 

The winlogon notification subscriber

took 481 second(s) to handle the notification event (Logon).

 

When digging down into the GroupPolicy Operational log I get a few more errors:

 

The LDAP call to connect and bind to Active Directory completed.

curric-server1.

domain

.sch.uk

The call failed after 240148 milliseconds.

 

Group Policy failed to discover the Domain Controller details in 481388 milliseconds.

 

Error: Failed to register for connectivity notification. Error code 0x4CE.

 

I'm having trouble finding anything specific regarding these errors, hoping someone else here has a bit more experience and might be able to help me!

If anyone needs any more info or anything else I shall be watching this thread.

 

Edit: When running gpresult on a machine it gives "The user %User% does not have RSOP data"

 

Thanks

James.

Edited October 2, 2012 by jlucas

[Ergo]

@jlucas from the sounds of that error message the server which the client machine is trying to connect to is ignoring the connection request to the LDAP database. In my experience this kind of thing happens when

- the server the client is trying to connect to is not longer a domain controller

- the server the client is trying to connect to is busy and cannot deal with the number of requests it is receiving

- there is a network error preventing the client connection from reaching the server

 

I hope these suggestions help.

 

Regards,

 

David

[Darylrese]

We get a very simular error and sometimes takes upto 40mins for users to logon!!

[ZeroHour]

I would stop the firewall service first (or set to manual) unless you have already done that as windows could be preventing access if it thinks the network configuration has changed.

In the event log is the nic coming up properly?

[jlucas]

@Ergo - Yes some sort of network/connection problem was the conclusion I was coming to.

@ZeroHour - Firewalls are turned off as standard on the domain. Services are running but the firewall is disabled. Can't see any problems with the NIC on any of the 3 DCs or the clients.

 

Thanks for your help so far guys.

[jlucas]

Just bumping this thread with more info. So far I have:

 

Re-imaged the machine.

Re-written (re-made) the group policies from scratch.

Made new machine and new user accounts in AD.

Moved the machines to a different switch (changed for one in a working room)

 

I'm starting to despair a bit!

 

I'm open to any ideas no matter how weird or out there!

 

Edit: Group Policy is now not giving any errors and is pulling down all correct settings (folder re-direction/restrictions/etc) except for the proxy.

 

Proxy is ticked but the box is blank.

 

Doesn't give any errors in Event Viewer, keeps telling me everything executed successfully!!

 

Thanks

James

Edited October 9, 2012 by jlucas

[dhoward_westexetc]

Just bumping this thread with more info. So far I have:

 

Re-imaged the machine.

Re-written (re-made) the group policies from scratch.

Made new machine and new user accounts in AD.

Moved the machines to a different switch (changed for one in a working room)

 

I'm starting to despair a bit!

 

I'm open to any ideas no matter how weird or out there!

 

Edit: Group Policy is now not giving any errors and is pulling down all correct settings (folder re-direction/restrictions/etc) except for the proxy.

 

Proxy is ticked but the box is blank.

 

Doesn't give any errors in Event Viewer, keeps telling me everything executed successfully!!

 

Thanks

James

 

I had the same thing.

 

Make a separate GPO just with the proxy settings and add that to the top of the list - worked for me!

[ricki]

Hi

 

Have the machine come from the same image?

Have you turned in verbose logging.

Have you done a gpresult on the client

Have you done a group policy modeling in in group policy?

Have you checked your dns try nslookups?

If you are running windows 7 is ip6 disabled

Is rss and autotunneling disabled if using windows 7

Is there anything in the event logs of the servers?

Are your domain controller replicating try a repadmin /showrepl

Have you tried a rsop.msc on the client

 

You might have a corrupt policy.

 

Richard

[SimonWindisch]

Just in case anyone comes across this in the future, I recommend taking the computer off the domain, renaming it, and rejoining it to the domain. I think the problem may be in a record relating to that computer on the domain.

 

Simon