Jump to content

GPOs over WiFi not applying (Windows 10)

DJ-1701

By DJ-1701
in Windows 10

 Share

Recommended Posts

DJ-1701

DJ-1701

Posted
Posted

A bit of an odd one, I have noticed GPOs apply fine over a wired connection with no issue, but when rebooting without a physical connection, I can not get them to apply over wireless. I've tried different laptops (with different WiFi cards) and tried the following policy settings with no luck.

 

- Specify startup policy processing wait time = 60 seconds

- Always wait for the network at computer startup and logon = Enabled

- Configure Group Policy slow link detection = Enabled: 0 kbps

 

'Specify startup policy processing wait time' doesn't make any difference, after around 15 seconds of 'Applying computer settings' it goes to 'Please wait for the Local Session Manager' and then allows you to login displaying a connected wireless network.

 

Anyone else come across this in Windows 10 and/or have any ideas?

DJ-1701

DJ-1701

Posted
  • Author
Posted

Thanks for replying, policies are in an inconsistant state when running a force, but says it needs to reboot to apply certain changes. Unfortunately these are still not applying on reboot.

 

With regard to UNC hardening, great minds think alike @Boredguy also suggested this, but the work around unfortunatly didn't work, and looking at the comments the UNC hardening case appears to be happening on wired and wireless.

 

I've even tried this... Dilbert Comic Strip on 1994-02-03 | Dilbert by Scott Adams

sjatkn

sjatkn

Posted
Posted

I had similar problems with some Toshiba L9W tablets. I did what @DJ-1701 did with no joy.

 

Two things changed at the same time, so i don't know which was the real solution.

 

We changed from DHCP to static addresses on these devices.

Ensured all updates were applied.

 

We were up against a deadline so didn't have time to go into it further, to find out which one really solved the problem.

  • Thanks 1
DJ-1701

DJ-1701

Posted
  • Author
Posted
Nothing concrete unfortunately. I have noticed an error about reading the GPT.INI on the RM SafetyNet Certificate policy... though there is no problem with the access rights and file. There was an error about 'boot-start or system-start driver(s) failed to load' which looks like it could be related to an old MSI. As most software is superfluous for testing at the moment, stripping out the autodeployment to see if the issue is still in place.
themightymrp

themightymrp

Posted
Posted (edited)

I know that we are talking about different models of laptops here, but what WiFi cards are in them? I just read on another site about something very similar to this happening with Intel branded cards and a new driver was required to fix it.

 

 

EDIT: Having not done much testing with Windows 10 laptops yet (only desktops), could WiFi Sense settings be causing an issue?? You could try switching it off just to tick another box

 

https://support.microsoft.com/en-us/kb/3085719

Edited by themightymrp
Tom

Tom

Posted
Posted
Im currently experiencing this on some linx tablets with win10 on. I think it is wireless driver related. These things were fine until I reinstalled a load of drivers to get other things working in device manager. I have other models of device with the same windows 10 image on and they are not experiencing it.
Boredguy

Boredguy

Posted
Posted

Power modes made no difference (device was already set to high performance and never power down WiFi) and as soon as the applying computer settings stage comes up it is picking up an IP address from the network straight away.

 

Will put it down to a bug with the current release and will wait for the next update and try again.

themightymrp

themightymrp

Posted
Posted

If you look in the Group Policy Event Log (see my earlier post), are you all seeing an issue related to not being able to read a GPT.ini file?

 

I'm wondering if one group policy is causing an issue and preventing the rest from processing? Also, when on WiFi are you able to browse to the \\domain\sysvol folder just to make sure DNS etc is working correctly (this is part of a second train-of-thought)

Boredguy

Boredguy

Posted
Posted

Yes it still gives the error "The system calls to access specified file completed. \\domain\sysvol\domain\policies\{GUID}\gpt.ini The call failed after 109 milliseconds" for and it can vary between different policies on boot up.

 

Already verified it can access \\domain\sysvol, as laptop will happily logon a domain user and process it's GPO's, but just won't process them for the station at boot up.

 

I even went through the process of migrating our sysvol from FRS to DFRS last week to rule out any replication issues with the GPO's.

Tom

Tom

Posted
Posted

I put mine on max performance and it makes no difference.

 

I am also seeing an error about a gpt.ini in the event log. Always seems to be one that is at the domain root. However other machines are getting it fine and it gives no error on the affected laptops when on a wire.

 

I am getting some errors in the event log from the wireless card on these devices which don't seem to be happening on others.

 

I had these tablets working perfectly on the wireless on monday - but they were missing some drivers. It is since the driver update that they have stopped working.

themightymrp

themightymrp

Posted
Posted

@Tom - if you browse to this GPT.ini file, does it open ok? On each of your DC's? Just wondering if maybe a copy is corrupt somewhere. You could always delete and recreate one by copying the contents, I think they usually only have 2 lines to do with the version number.

 

Could you also check the binding order of the WiFi card, try disabling IPv6 if you don't specifically need it.

Tom

Tom

Posted
Posted
@Tom - if you browse to this GPT.ini file, does it open ok? On each of your DC's? Just wondering if maybe a copy is corrupt somewhere. You could always delete and recreate one by copying the contents, I think they usually only have 2 lines to do with the version number.

 

 

I have looked at multiple DC's and cannot find a corrupt copy of this gpt.ini file. No other machines are complaining about it. I think this error is a consequence of some of these issues rather than the root cause of this problem.

 

The GPO is on the root of the domain (and is the bottom one in the list when you do gpresult /r /scope:computer) - so it looks like it is the first one it should be applying.

 

I am also seeing errors from WLAN-autoconfig in the system log that seem to happen on bootup just before the gpt.ini errors saying "WLAN extensibility module has failed to start

c:\windows\system32\Rrlihvs.dll". I asssume this is part of the realtek wireless driver.

 

Annoyingly I cant seem to un-install the current version of the driver so that I can go back to an older version (which has worked on many other drivers on this tablet) as it has no checkbox to uninstall the driver files!

 

Could you also check the binding order of the WiFi card, try disabling IPv6 if you don't specifically need it.

I am not on site to try this right now. Can somebody else give it a go?

 

I do have a device offsite though and have checked. IIPv6 is enabled at the moment, but there is no wired lan interface on it (I have been using a USB dongle) so the wifi is top of the list above Remote Access Connections.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
 Share
Go to topic listing


×
×
  • Create New...