Solved

ANOTHER Windows cannot access the file gpt.ini for GPO case...

Posted on 2008-06-23
18
914 Views
Last Modified: 2010-04-21
Okay - I'm having the same problem which is well dcumented here:

http://www.experts-exchange.com/Operating_Systems/Windows_Server_2003/Q_21587377.html

The Fix by Marc Nivens: "Open ADU&C, right click on the domain controllers OU, properties.  Go to the policy tab, highlight the domain controller security policy and click permission.  Grant the Enterprise Domain Controllers and Authenticated Users groups "apply group policy" permissions.  Then run gpupdate and see if the error returns".  

I get as far as: "Open ADU&C"...  right click on the domain controllers OU, properties (where?)

I don't see either of my two DC's listed in the list under the "Computers" folder in order ...  




0
Comment
Question by:LTWadmin
  • 8
  • 8
  • 2
18 Comments
 
LVL 59

Accepted Solution

by:
Darius Ghassem earned 500 total points
ID: 21848901
Go to the DC OU right-click then go to properties. Go to the Group Policy tab select the default domain controller policy then click properties then go to security tab and you will see the rest.
0
 

Author Comment

by:LTWadmin
ID: 21849449
Okay thanks - that helped.  I checked the permissions on both and ran the gpupdate command.  The Enterprise Domain Controllers group did NOT have the Apply Group Policy option checked.  The other "authenticated users" did.  

Stil getting the error though...

Windows cannot access the file gpt.ini for GPO CN=31B2F340-016D-11D2-945F-00C04FB984F9,CN=Policies,CN=System,DC=ourdomain,DC=org. The file must be present at the location <\\ourdomain.org\sysvol\ourdomain.org\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (The network name cannot be found. ). Group Policy processing aborted.

Event ID 1030 in the System Even Log: Windows cannot query for the list of Group Policy Objects.  Check the event log for possible messages previusly logged by the policy egine that describes the reason for this"...

?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21849489
0
 

Author Comment

by:LTWadmin
ID: 21849668
Thanks again.  I was uncouraged until:

3. In the Registry Editor window, locate the following registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Mup
4. In the right details pane, double-click DisableDFS.
 
There is no "DisableDFS" key in my details pane under the "Mup" directory...  

I checked the path twice...

figures...

?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21849806
See if this works.

http://www.experts-exchange.com/OS/Miscellaneous/Q_21205363.html

FIX:
Check Trusts, if there is a REALM trust with another DC on the same domain.  Remove it.  Reboot servers.  It will work.  If it doesn't and you have tried every other KB or article from above, call Microsoft.
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21849829
Your DNS and AD is working fine, right? Have you restart the netlogon service?
0
 

Author Comment

by:LTWadmin
ID: 21849882
Yes - as far as I can tell.  I just did the start/stop.  Stand by...
0
 

Author Comment

by:LTWadmin
ID: 21849948
Looks like they're still coming...  

A reboot later maybe?
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21849976
When did these errors start happening? Did you change anything or updates? Do you have SP1 installed? If you do don't worry about  the hotfix but still do the dfsutil.

To resolve event id 1030 and 1058 immediately, contact Microsoft to obtain
the hotfix (the hotfix is free - knowledge base 842804).
As workaround open the command prompt type dfsutil /PurgeMupCache, and then
press ENTER.
0
Backup Your Microsoft Windows Server®

Backup all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21850013
Are you getting any other errors?
0
 

Author Comment

by:LTWadmin
ID: 21850158
No other errors.  SP1 is installed.  They appear to have started as a result of one of two things.  There was a power outage in the reginal area tday.  Our servers are UPS supported but I powered them down smoothly and restarted them all.

Or (least likely)

It may have been trigerred when I created a new photo library in Sharepoint on the server.  The timing directly coincided with this...

"for what ever reason the "dfsutil" command isn't recognized on this machine.  I have become pretty furstrated at this point and will pickj up here tomorrow.  I suppose I'll just have a mailbox full of error messages.  You will be on the points list as soon as I can resolve this.  I appreciate al your help!  Will probably go for the Microsoft hotfix...
0
 

Author Comment

by:LTWadmin
ID: 21850171
Here's the current error:

EVENT # 19639
EVENT LOG Application
EVENT TYPE Error
SOURCE Userenv
EVENT ID 1058
USERNAME NT AUTHORITY\SYSTEM
COMPUTERNAME   BUSINESSSERVER
TIME 6/23/2008 4:35:02 PM
MESSAGE Windows cannot access the file gpt.ini for GPO CN=31B2F340-016D-11D2-945F-00C04FB984F9,CN=Policies,CN=System,DC=ourdomain,DC=org. The file must be present at the location <\\ourdomain.org\sysvol\ourdomain.org\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (The network name cannot be found. ). Group Policy processing aborted.
 
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21850289
dfsutli is here

http://www.microsoft.com/downloads/details.aspx?FamilyId=6EC50B78-8BE1-4E81-B3BE-4E7AC4F0912D&displaylang=en

There are tons of solutions for these errors. Also, if you have SP1 then the hotfix won't apply to you. Is file and printer sharing on? Is SYSVOL still sharing? Try to type \\127.0.0.1 in the run box on the DC to see if the SYSVOL is showing as a share and if you can access the folder without any errors.
0
 
LVL 38

Expert Comment

by:ChiefIT
ID: 21863154
Netbios is a non-routable protocol. GPOs are populated in the SYSVOL record and distributed out to clients and servers using Netbios broadcasts.  By non-routable, this means it will not go over a VPN connection, through a firewall, or across NIAT.

If you have a route to go over, then you should use WINS as the transporter. A quick and very easy test for routing problems is to go into MY NETWORK PLACES and see if the server with the SYSVOL SHARE,  that holds the GPO you are trying to get, is listed. Since the browser service will also not work, (because it uses Netbios broadcasts), you shouldn't see the server in MY NETWORK PLACES.  

Netbios broadcasts are done on a local lan. Enabling Netbios over TCP/IP is the protocol and WINS is the transport to remote comptuers. An example:

Clients and servers site 1 all using netbios over TCP/IP____WINS connection between the servers____ Servers and clients at site 2 all using netbios over TCP/IP

An alternative fix to the transport is to use DNS for Distributive File shares (DFS). DFS is used to populate a list of shares and GPOs in sysvol that is shared out to the lan, like group policy objects. It is similar to Apple talk in that respect.

If the inability to route Netbios is your problem, there are two fixes to this:

FIX 1) So, here is what you do. You can configure WINS. Below, is an article on how to configure WINS for the Master browser service. All you want is a transport through the VPN tunnel.
http://www.microsoft.com/resources/documentation/windowsnt/4/server/reskit/en-us/net/chptr3.mspx?mfr=true

Alternative fix: Fix 2) An alternative fix is to use DNS as the transport for DFS:
 http://support.microsoft.com/kb/244380
PLEASE NOTE: Please look at the key ports used by Windows 2003 anything using ports 137, for WINS and Netbios datagram ports 138 and 139 are effected if you do not use WINS. If all you are after is DFS, then you could use DNS. So, there are drawbacks to using DNS.
0
 

Author Comment

by:LTWadmin
ID: 21865035
dariusg: File and Printer sharing is on.  It's a file and print server.  Ssvol is showing as a share.  Not sure what you mean when you ask if I can access it but I can open it without any problems.

ChiefIT: that all went a little over my head.  In fix one, VPN is mentioned but the server is in no way associated with our VPS service here (other than outside clients access it through VPN).  Is that the intended message?   I can tell you that WINS is enabled on the machine and actually points to itself for the IP.  Interestingly, every time I close the WINS Tab and go to close TCP/IP properties, I get a multiple gateways warning...
0
 
LVL 38

Expert Comment

by:ChiefIT
ID: 21868316
Check out the last comments and illistration I made on this post and see if that clarifies things.

http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/Q_23507742.html?cid=238#a21866098
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 21869357
Have you ran the dfsutil /PurgeMupCache?
0
 

Author Closing Comment

by:LTWadmin
ID: 31469887
Thanks
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Preface Having the need * to contact many different companies with different infrastructures * do remote maintenance in their network required us to implement a more flexible routing solution. As RAS, PPTP, L2TP and VPN Client connections are no…
So you have two Windows Servers and you have a directory/folder/files on one that you'd like to mirror to the other?  You don't really want to deal with DFS or a 3rd party solution like Doubletake. You can use Robocopy from the Windows Server 200…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now