Printserver Failed GPUpdate

[Techdw]

Hi,

 

Having an issue today with the printserver, when i do a Gpupdate/force its saying the user policy has updated successfully but the Computer policy could not be updated successfully..

 

 

C:\Users\Administrator.DOMAIN>gpupdate /force

Updating Policy...

 

User Policy update has completed successfully.

Computer policy could not be updated successfully. The following errors were encountered:

 

The processing of Group Policy failed. Windows attempted to read the file \\DOMAIN.local\sysvol\DOMAIN.local\Policies\{FF122C7B-DC32-4153-A453-76451C39DCDD}\g

pt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

a) Name Resolution/Network Connectivity to the current domain controller.

b) File Replication Service Latency (a file created on another domain controller

has not replicated to the current domain controller).

c) The Distributed File System (DFS) client has been disabled.

 

To diagnose the failure, review the event log or invoke gpmc.msc to access infor

mation about Group Policy results.

 

If I gpupdate form any other server it works fine!

[Techdw]

Any advice would be good.

[Michael]

I'm guessing (from what you're describing) you have more than one DC in your network. I suspect there may be some form of replication issue between the one server and your other servers.

 

Try manually configuring which DNS server a workstation should talk to first. This should allow you to determine if there's a problem or not.

[Techdw]

Yes, I have two DC's.

Just done a NSlookup on DC1 to its self and its coming back as '' unknown'' Its looking at the mac address of the first nic card! I have currently got it plugged into the second! Been like this for a while and only just started playing up

[Michael]

I think that's normal to be honest.

 

If you run dcdiag on the server, does it look healthy?

[Techdw]

An error event occurred. EventID: 0xC0000827

Time Generated: 01/24/2013 10:26:00

Event String:

Active Directory Domain Services could not resolve the following DNS

host name of the source domain controller to an IP address. This error prevents

additions, deletions and changes in Active Directory Domain Services from repli

cating between one or more domain controllers in the forest. Security groups, gr

oup policy, users and computers and their passwords will be inconsistent between

domain controllers until this error is resolved, potentially affecting logon au

thentication and access to network resources.

......................... DC01 failed test KccEvent

Starting test: KnowsOfRoleHolders

......................... DC01 passed test KnowsOfRoleHolders

Starting test: MachineAccount

......................... DC01 passed test MachineAccount

Starting test: NCSecDesc

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

Replicating Directory Changes In Filtered Set

access rights for the naming context:

DC=ForestDnsZones,DC=DOMAIN,DC=local

Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have

Replicating Directory Changes In Filtered Set

access rights for the naming context:

DC=DomainDnsZones,DC=DOMAIN,DC=local

......................... DC01 failed test NCSecDesc

Starting test: NetLogons

......................... DC01 passed test NetLogons

Starting test: ObjectsReplicated

......................... DC01 passed test ObjectsReplicated

Starting test: Replications

......................... DC01 passed test Replications

Starting test: RidManager

......................... DC01 passed test RidManager

[Michael]

So I'm right, there is a replication issue. Please check DNS is correct on all servers and their adapters to correct the issue.

[Techdw]

DNS looks OK on all the servers

[Michael]

If you manually force replication through Sites and Services, does it work or give an error?

[Techdw]

I tried that and still get the error

[Techdw]

Still get the error when i do DCDiag

[Michael]

Try clearing all event logs on the server:

 

Copy/paste this and save as 'Clear event logs.bat'

 

@echo off
FOR /F "tokens=1,2*" %%V IN ('bcdedit') DO SET adminTest=%%V
IF (%adminTest%)==(Access) goto noAdmin
for /F "tokens=*" %%G in ('wevtutil.exe el') DO (call :do_clear "%%G")
echo.
echo goto theEnd
:do_clear
echo clearing %1
wevtutil.exe cl %1
goto :eof
:noAdmin
exit

 

Then re-run dcdiag. If you still have problems, there's a replication problem you'll still need to fix.

[Techdw]

Just done that, everything is spot on except still same problem.

[Michael]

If DNS looks OK, check the static DNS config on the problematic server.

 

It should point to itself first, then other DNS servers second and third etc... and optionally external DNS servers last.

[Techdw]

What's the easiest way of finding out what GPO this is without having to go through them all

 

\\DOMAIN.local\SYSVOL\DOMAIN.local\Policies\{FF122C7B-DC32-4153-A453-76451C39DCDD}

[Techdw]

If DNS looks OK, check the static DNS config on the problematic server.

 

It should point to itself first, then other DNS servers second and third etc... and optionally external DNS servers last.

 

On the problem server it does point to itself first, this was one of the first things I checked.

[Michael]

What's the easiest way of finding out what GPO this is without having to go through them all

 

\\DOMAIN.local\SYSVOL\DOMAIN.local\Policies\{FF122C7B-DC32-4153-A453-76451C39DCDD}

 

If you locate the workstation Computer Object in Active Directory, (where you ran gpupdate) this should allow you to narrow down which GPO is creating the issue in Group Policy Management, unless you have absolutely loads of linked GPOs?

 

I'm not sure of a way to link a GPO to a SID as they're all randomly created for your domain.

[Techdw]

Windows Server 2008 Domain Controllers fail NcSecDesc (Naming Context Security Descriptors) test when dcdiag is run - Ravindra Pamidi's Blog - Site Home - TechNet Blogs

 

Says if I don't plan to run RODC then disregard this message

[Michael]

That's correct. Server 2008 or later allow you to have Read Only Domain Controllers as an option.

 

By inserting your installation disc and running:

 

adprep /rodcprep

 

You can do this live on your FSMO role holder without restarting the server. This will then replicate out to your other DCs. When you run dcdiag that error should no longer appear.

[Techdw]

even without this i shouldn't be getting this error when doing a gp-update on the printserver..

 

May have to flatten it and build it again.

[Techdw]

Still having problems with this, I don't really want to flatten the server and start again

[Techdw]

Bump. Hitting a wall with this

[Michael]

If everything else runs OK on the server and depending what other services you're running on it, you could run dcpromo, demote it as a DC reboot then re-promote it as a DC. Any bad info would be lost as it would replicate from the remaining good DCs.

 

If DNS etc... is correct then in theory you should be able to demote. If it isn't correct you will get errors that's for certain.