Avatar of DeNzMoR
DeNzMoR
 asked on

Dont want to load GPOs on AD server

Ok,

I have a problem with some GPOs and im not able to find where the problem is from. I have an error in event viewer every 10min

Userenv
Description :
Windows couldn't log the RSoP (Resultant Set of Policies) session status. An attempt to connect to WMI failed. No more RSoP logging will be done for this application of policy.

I would like to know if theres a way to not load any gpos on my server. Is it possible or I will screw my only ad server.

Is there any tools that debug gpos, so I can find whats the problem.

Because since I have this message, my server is really slow

Do you think a repair from the cd would fix this problem? I've looked on the internet and tried mostly all solutions and im kinda desperate.

Any help will be appreciated.
Windows Server 2003

Avatar of undefined
Last Comment
DeNzMoR

8/22/2022 - Mon
AnthonyP9618

Do this...

Run gpresult > C:\gpresult.txt from a command prompt window.  Once complete, open up the gpresult.txt file in the root of C.  This should show the list of applied and filtered Group Policies for this server.  We're going to focus on the list of applied Group Policies.

Create a new Global Security Group in AD called MemberServer-NoGPO (or whatever you want).  Open up Group Policy and find the Group Policies that we found were applying to the server we ran gpresult on.  In each of these policies we want to add the MemberServer-NoGPO into the Security of Group policy.  Once added, check DENY for Apply Group Policy (should be the last entry).  Repeat this process for each Group Policy that is being applied to our target server.  Once complete, add the server into this group.  Ensure that you force or wait for repliaction occur for all DCs in the site.

On the target server, perform a GP force.. type gpupdate /force from a command prompt on the target server to force group policy updates.

Re-run the gpresult command above and compare the output to the previously generated file.  If the securities took, there should be no group policies applying to this server.  In fact, you should see that group policies that once were applying to the server have now been filtered out by Security.

From there you should be able to enable a single GPO at a time by removing the security group in the GP, forcing replication amoung the DCs and forcing a GPupdate on the target server.  

Hope that helps.
life_j

DeNzMoR

ASKER
life_j I tried that and its not working.

Thanks Anthony, I will try this asap and keep you in touch.
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
Bradley Fox

If you do not want the GPOs applied to a specific server just edit the security of the GPOs and add the servername (you will have to select types and check off computers) then check the Deny box next to apply Policy for the server.
ASKER CERTIFIED SOLUTION
Stephen Manderson

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
DeNzMoR

ASKER
I tried the gpresult and it tooks like 5 min and after that I got this error messager

server execution failed.....
DeNzMoR

ASKER
MrManderson
Ive seen this page and nothing is working....
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
DeNzMoR

ASKER
I have several dcom errors in event viewer also

The server {000C101C-0000-0000-C000-000000000046} did not register with DCOM within the required timeout.

The server {8BC3F05E-D86B-11D0-A075-00C04FB68820} did not register with DCOM within the required timeout.

The server {BA126AE5-2166-11D1-B1D0-00805FC1270E} did not register with DCOM within the required timeout.
Stephen Manderson

The First GUID is an error with the Microsoft Installer.
http://support.microsoft.com/kb/309282/en-us

The Second has to do with the RPC
http://support.microsoft.com/kb/839880/en-us

The thirds one I cant seem to find any info on

This may help fix some of you're com issues
http://support.microsoft.com/kb/910730/

I will look into you're RSoP error more

DeNzMoR

ASKER
I re-register msiintaller and now Im able to uninstall programs.

Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
Bradley Fox

Is this server running Terminal Services?
http://support.microsoft.com/?kbid=873375

This is probably stupid but did you try a gpupdate /force ?
Stephen Manderson

Im not a big fan of posting links to other experts answers but this may be of use to help you solve it quicker.

https://www.experts-exchange.com/Networking/Microsoft_Network/Q_21126829.html?query=1090+userenv&clearTAFilter=true

Bradley Fox

Everything always seems to come back to DNS so I would try just for the heck of it.

Make sure primary DNS on the offending DC is pointing at itself and it's running DNS with a AD integrated zone hosting your domain.

Stop and start the netlogon service.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
DeNzMoR

ASKER
yeah I had ts server running but I uninstall it and even the ts server licensing. I tried gpupdate /force many times
when I was runnign the mof-thing command line
Stephen Manderson

You should consult with microsoft they may have non published tools that may sort this problem.

Regards
Steve
Bradley Fox

I would suggest calling Microsoft to obtain the hotfix that is explained in the link from my previous post.
This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
DeNzMoR

ASKER
theres no way it can be a dns problem.
Bradley Fox

I was referring to the hotfix from this post:

Is this server running Terminal Services?
http://support.microsoft.com/?kbid=873375
DeNzMoR

ASKER
ive noticed theres some memory leak with svchost.exe (SYSTEM)
its taking 800mb atm.. Ill try uninstall my antivirus program.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
DeNzMoR

ASKER
Only repairing windows 2003 solved the problem. But im going to give the points to MrAnderson since he helped me the most.