[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

DHCP & Group Policy Problem

Posted on 2009-12-16
14
Medium Priority
?
1,123 Views
Last Modified: 2012-06-27
We have an SBS 2003 domain and some problems with DHCP and Group Policy.

When a workstation is set to DHCP, it boots up as normal, but when it loads into Windows it sometimes skips the "preparing network connections" bit. This causes Windows to reject credentials as it cannot see the domain controller because it has no network settings. However, reboot the PC and it'll work - but this issue is random and keeps happening.

The second issue we're having is with Group Policy whereby when a PC boots into Windows, the user will log in but only half of the Group Policy settings would have been applied. For example desktop customisations may be set, but the Windows Firewall will say "using your non-domain settings", which would block most traffic, such as Remote Desktop and ICMP packets.

Are the two problems related? Can anyone help me?

I've had to switch problematic PCs to static IP for the time being to sort out the DHCP issue, but obviously it not the fix and the DHCP issue is still occurring with other PCs at random intervals. The Group Policy issue however is always occurring. There are no errors in the event viewer, both client and server side.

All workstations are Windows XP Pro SP3.

Any help appreciated. Thanks in advance.
0
Comment
Question by:DReade83
  • 7
  • 5
  • 2
14 Comments
 
LVL 8

Assisted Solution

by:dicconb
dicconb earned 1496 total points
ID: 26064382
Hi DReade83,
Your two problems might be related, but we will need to get some more information before we can say definitely.
DHCP problem
What network switches are your workstations plugged into?  Please could you reply with the make and model (eg Cisco 2950)
Sometimes DHCP fail if there is a delay establishing the connection to the switch - I have seen this happen on Cisco switches in the following situations:
* Workstation plugged into a port with STP enabled
* Workstation with a gigabit ethernet card is connected to a 10/100 ethernet switch and set to autonegotiate
Further info from Cisco here: http://tinyurl.com/2e29bw
Group Policy problem
If the workstation doesn't receive an IP address, it won't be able to connect to your SBS server and Group Policy won't run.  To help troubleshoot this further please could you run "gpresult" at a command prompt on a workstation that's working correctly, and also one that is having problems, and paste the output from both workstations into your reply?
Firewall problem
If the DNS suffix isn't configured correctly on your network card, Windows can't tell which network it's on.  Please could you run "ipconfig /all" on an affected workstation and post the output here?
Cheers,
D
0
 
LVL 27

Assisted Solution

by:bluntTony
bluntTony earned 504 total points
ID: 26064673
HI there,
I think dicconb may may onto something with the switches. I have seen issues with DHCP on Cisco switches STP is enabled but where 'Spanning Tree Port Fast' isn't enabled on the ports the clients are connected to. The result is that DHCP takes a inordinate amount of time, or times out. I would check this.
Along with a gpresult, check your event logs (Application) for any usernev errors or warnings. Let us know what they are. Also an RSoP query might help you uncover why certain policies may or may not be applying (run rsop.msc and browse to the policies in question).
Tony
 
0
 
LVL 8

Assisted Solution

by:dicconb
dicconb earned 1496 total points
ID: 26091957
Have you had any luck resolving this problem? Let me know how it worked out, or if you need any more assistance.

Cheers,

D
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

 

Author Comment

by:DReade83
ID: 26291991
Sorry for the late reply. I disabled STP on the switch and tried booting with a static IP on the problematic machine.

Group Policy is now applied everytime.

However when I turn on DHCP instead and then reboot, 9 times out of 10 the machine boots but fails to apply Group Policy. The Windows Firewall is a good example here as it says at the bottom of the dialog bog "Windows Firewall is using your non-domain settings". If at this point I perform a GPUPDATE /FORCE and then reload the Windows Firewall dialog box, it then says "Windows Firewall is using your domain settings".
0
 
LVL 27

Assisted Solution

by:bluntTony
bluntTony earned 504 total points
ID: 26294085
Instead of disabling STP, have you tried enabling Port Fast on the switch ports in question? (all the way through to the server)

Tony
0
 

Author Comment

by:DReade83
ID: 26444467
Sorry what's Port Fast? I don't think I've seen that option on our switch. Does it have any other names? It may be called something different on our switch.

In addition I'm performing an upgrade to SBS 2008 today, so I'll know for sure if it was SBS 2003 causing the issue, or whether it's something else (i.e. the switch). I'll keep you posted.
0
 
LVL 8

Assisted Solution

by:dicconb
dicconb earned 1496 total points
ID: 26444547
What make and model of switch are you using?  The Cisco page I posted a link to above has instructions for most Cisco switches.
0
 

Author Comment

by:DReade83
ID: 26532504
Sorry, we're using a Dell PowerConnect 6248P.

Whenever it's powered off it resets to factory defaults. It's out of warranty so we can't ask Dell. Could it be related to the backup battery inside, and if so could the backup battery be causing what we're seeing?
0
 
LVL 8

Assisted Solution

by:dicconb
dicconb earned 1496 total points
ID: 26532763
On Cisco switches there is a command to write the running config to flash, which preserves changes during a reboot. Will see if I can find the euivalent command for you.
0
 
LVL 8

Assisted Solution

by:dicconb
dicconb earned 1496 total points
ID: 26537288
On a Dell PowerConnect switch, if you make changes to the configuration you must save the running config to flash or the changes will be lost when it is rebooted. You can do this either from the web interface or from the command line on the switch

Web Interface method:
Log on to web interface
Browse to Switch > Configuration
Click Copy Running Config to File to save the config
Click Start-up Configuration File
Ensure the file you just saved is selected

Command Line method:
Connect to the switch by Telnet or by using a console cable
Type enable
Enter the username and password
Type copy running-config startup-config

Good luck!
0
 

Author Comment

by:DReade83
ID: 26848118
Sorry for the delay, our new installation is not quite finished yet but I expect it to be live at the start of next week where we'll see if whether this has cured the DHCP issue. I'll keep you posted.

Thanks for your patience.
0
 
LVL 8

Assisted Solution

by:dicconb
dicconb earned 1496 total points
ID: 26848139
No problem, let us know how it goes. D
0
 

Accepted Solution

by:
DReade83 earned 0 total points
ID: 27722298
Looks like it was a dodgy SBS installation after all. SBS 2008 doesn't appear to have the same problems as the 2003 installation.
0
 
LVL 8

Expert Comment

by:dicconb
ID: 27913656
Glad you got it fixed! D
0

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
Microsoft Office 365 is a subscriptions based service which includes services like Exchange Online and Skype for business Online. These services integrate with Microsoft's online version of Active Directory called Azure Active Directory.
This Micro Tutorial hows how you can integrate  Mac OSX to a Windows Active Directory Domain. Apple has made it easy to allow users to bind their macs to a windows domain with relative ease. The following video show how to bind OSX Mavericks to …
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question