Machine not getting group policy updates

This is the error that I am getting.

The processing of Group Policy failed. Windows attempted to read the file \\kba.local\SysVol\kba.local\Policies\{15884B1E-7640-4172-975A-6F0DC37F2F10}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.


I have recently created a virtual DC and then gave it 10 days to replicate with the original 2 physical DC's. I then took one off line this morning with the plans to move it to our off site back-up facility for disaster recovery reasons. I do have one machine that is running a little slow and the network drivers will not map. So I went out to update the Group policy and that is when I got this error message. I can ping by name from the DC's to the machine and also the machine to the DC's. Any help would be great.
Kelly-BradyAsked:
Who is Participating?
 
Darius GhassemCommented:
Well you can't because you are having replication errors.

You should not have a DC shutdown for long periods of time since this will cause corruption and replication errors which will then cause issues with your other DCs.
0
 
Matt VCommented:
You mention the network is slow from this PC, when you do a ping, do a ping -t and watch it for a few minutes to see if it is dropping packets.
0
 
ozboingCommented:
Can you open \\kba.local\SysVol\kba.local\Policies\ from the pc?
0
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

 
Darius GhassemCommented:
You need run dcdiag then post results. Make sure you are only pointing to internal DNS servers only
0
 
Kelly-BradyAuthor Commented:
Which machine should I run this on? And I can open that location from my machine but when I go to her machine I can not ge to it, and that is logged in as her and as me.
0
 
Darius GhassemCommented:
Dcdiag needs to be run on server.

Again sure make server that the clients only point to the DC for DNS in their TCP\IP properties and the DC points it other DCs only
0
 
Kelly-BradyAuthor Commented:
Ok I need a little clarification, you ar saying that my clients should only point to one of my DC's for DNS, and then that DC should point to the other one?
0
 
Darius GhassemCommented:
No, what I am saying is clients should only be pointing to your DCs for DNS (internal DNS servers) and your DC should be pointing to other DCs for DNS only (internal DNS servers). There should be no external DNS servers listed
0
 
Kelly-BradyAuthor Commented:
Ok here it is and I see where it is having the replication issue, the thing is then how would I proceed to move this domain controller off site if I can not even turn it off?



Microsoft Windows [Version 6.0.6001]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

C:\Users\Joe.Sparks>dcdiag

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = dc01
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\DC01
      Starting test: Connectivity
         ......................... DC01 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\DC01
      Starting test: Advertising
         ......................... DC01 passed test Advertising
      Starting test: FrsEvent
         ......................... DC01 passed test FrsEvent
      Starting test: DFSREvent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared.  Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... DC01 failed test DFSREvent
      Starting test: SysVolCheck
         ......................... DC01 passed test SysVolCheck
      Starting test: KccEvent
         ......................... DC01 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... DC01 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... DC01 passed test MachineAccount
      Starting test: NCSecDesc
         ......................... DC01 passed test NCSecDesc
      Starting test: NetLogons
         ......................... DC01 passed test NetLogons
      Starting test: ObjectsReplicated
         ......................... DC01 passed test ObjectsReplicated
      Starting test: Replications
         [Replications Check,DC01] A recent replication attempt failed:
            From DC02 to DC01
            Naming Context: DC=ForestDnsZones,DC=kba,DC=local
            The replication generated an error (1256):
            The remote system is not available. For information about network tr
oubleshooting, see Windows Help.

            The failure occurred at 2010-09-01 07:51:15.
            The last success occurred at 2010-08-31 08:50:35.
            23 failures have occurred since the last success.
         [DC02] DsBindWithSpnEx() failed with error 1722,
         The RPC server is unavailable..
         [Replications Check,DC01] A recent replication attempt failed:
            From DC02 to DC01
            Naming Context: DC=DomainDnsZones,DC=kba,DC=local
            The replication generated an error (1256):
            The remote system is not available. For information about network tr
oubleshooting, see Windows Help.

            The failure occurred at 2010-09-01 07:51:15.
            The last success occurred at 2010-08-31 08:50:35.
            23 failures have occurred since the last success.
         [Replications Check,DC01] A recent replication attempt failed:
            From DC02 to DC01
            Naming Context: CN=Schema,CN=Configuration,DC=kba,DC=local
            The replication generated an error (1722):
            The RPC server is unavailable.
            The failure occurred at 2010-09-01 07:52:09.
            The last success occurred at 2010-08-31 08:50:35.
            23 failures have occurred since the last success.
            The source remains down. Please check the machine.
         [Replications Check,DC01] A recent replication attempt failed:
            From DC02 to DC01
            Naming Context: CN=Configuration,DC=kba,DC=local
            The replication generated an error (1722):
            The RPC server is unavailable.
            The failure occurred at 2010-09-01 07:51:42.
            The last success occurred at 2010-08-31 08:50:35.
            23 failures have occurred since the last success.
            The source remains down. Please check the machine.
         [Replications Check,DC01] A recent replication attempt failed:
            From DC02 to DC01
            Naming Context: DC=kba,DC=local
            The replication generated an error (1722):
            The RPC server is unavailable.
            The failure occurred at 2010-09-01 07:51:15.
            The last success occurred at 2010-08-31 08:51:12.
            23 failures have occurred since the last success.
            The source remains down. Please check the machine.
         ......................... DC01 failed test Replications
      Starting test: RidManager
         ......................... DC01 passed test RidManager
      Starting test: Services
         ......................... DC01 passed test Services
      Starting test: SystemLog
         ......................... DC01 passed test SystemLog
      Starting test: VerifyReferences
         ......................... DC01 passed test VerifyReferences


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : kba
      Starting test: CheckSDRefDom
         ......................... kba passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... kba passed test CrossRefValidation

   Running enterprise tests on : kba.local
      Starting test: LocatorCheck
         ......................... kba.local passed test LocatorCheck
      Starting test: Intersite
         ......................... kba.local passed test Intersite

C:\Users\Joe.Sparks>
0
 
Kelly-BradyAuthor Commented:
OK yes I have only internal DC's in the machine and the Server configs, no externals.
0
 
Kelly-BradyAuthor Commented:
So how would you propose for me to take one of the physical DC's offline and then also then move it to the off-site location? Would it be better to re-build it as a fresh domain controller at what will be our warm site.
0
 
Darius GhassemCommented:
So, the system would actually be running and connected to the other DCs when at the backup site?
0
 
Kelly-BradyAuthor Commented:
Yes we have a dedicated MPLS network between the two locations so it would actually see it as a local network.
0
 
Darius GhassemCommented:
Oh Ok then you should be good I thought you were saying it wasn't going to connect at all sorry should have not assumed.

When you shutdown a DC you can see issues like this because the clients are still trying to authenticate to the DC. Have you cut the DC back on?
0
 
Kelly-BradyAuthor Commented:
yes i just turned it back on.
0
 
Kelly-BradyAuthor Commented:
and now the drives remapped and I was able to updare group policy. So now the question remains on how do I remove this and get it moved to the off site location without causing this problem?
0
 
Darius GhassemCommented:
Make sure that no clients or domain controllers aren't pointing to this server for DNS. Make sure this server is not holding any fsmo roles.
0
 
Kelly-BradyAuthor Commented:
Ok I am goijg to check on this today and now I have anouther issue that I am not sure if it is related. I came in the this morning and my file and fax server were frozen and also several of my machines. Could this be connected to bringing the DC back online. When I did the research on this it seemed alot easier.
0
 
Kelly-BradyAuthor Commented:
I have two domain controllers that are not responding, and I am attaching some screen shots that i am getting from the one that is working.
dcPic1.PNG
dcpic2.PNG
0
 
Darius GhassemCommented:
Please post ipconfig /all.

Dcdiag
0
 
Kelly-BradyAuthor Commented:
I ended up restarting the other DC01 and DC02 and it seems to have settled down for now. So I do not know what has blown up or even a close understading as to why. I am going to paste in the roles that are on DC02.

dcPic3.JPG
0
 
Kelly-BradyAuthor Commented:
Is there a way to see if this server has any FSMO roles assigned to it?
0
 
Kelly-BradyAuthor Commented:
Ok i have checked and there are no FSMO roles assigned to DC02, they are all on DC01
0
 
Darius GhassemCommented:
So, when you run dcdiag what does it look like?
0
 
Kelly-BradyAuthor Commented:
This is DC01, do you want the results from all three DC's? I can run it and put it in a text file and attach it for you!

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = dc01
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\DC01
      Starting test: Connectivity
         ......................... DC01 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\DC01
      Starting test: Advertising
         ......................... DC01 passed test Advertising
      Starting test: FrsEvent
         ......................... DC01 passed test FrsEvent
      Starting test: DFSREvent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared.  Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... DC01 failed test DFSREvent
      Starting test: SysVolCheck
         ......................... DC01 passed test SysVolCheck
      Starting test: KccEvent
         ......................... DC01 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... DC01 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... DC01 passed test MachineAccount
      Starting test: NCSecDesc
         ......................... DC01 passed test NCSecDesc
      Starting test: NetLogons
         ......................... DC01 passed test NetLogons
      Starting test: ObjectsReplicated
         ......................... DC01 passed test ObjectsReplicated
      Starting test: Replications
         ......................... DC01 passed test Replications
      Starting test: RidManager
         ......................... DC01 passed test RidManager
      Starting test: Services
         ......................... DC01 passed test Services
      Starting test: SystemLog
         ......................... DC01 passed test SystemLog
      Starting test: VerifyReferences
         ......................... DC01 passed test VerifyReferences


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : kba
      Starting test: CheckSDRefDom
         ......................... kba passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... kba passed test CrossRefValidation

   Running enterprise tests on : kba.local
      Starting test: LocatorCheck
         ......................... kba.local passed test LocatorCheck
      Starting test: Intersite
         ......................... kba.local passed test Intersite
0
 
Darius GhassemCommented:
Well DC1 looks good there are still some replication errors but those could be old. What is the exact problem you are now having?
0
 
Kelly-BradyAuthor Commented:
I had half of my machines that needed hard restarts along with several of my servers and the only thing it could have been was bringing that DC02 back online. But that has seemed to be fixed. So now the question is how to fix the replication issue and I thinking that it would be better to just remove the DC completely then just rebuild it at the new location, just need to do research and find out what command you give to have it un-promote a DC. I have some issues with DC03 also, so I will need to fix these before I go any farther, I have attached a txt file with the DCDIAG from all three DC's.
DCDiag.txt
0
 
Darius GhassemCommented:
DC3 is having issues I would run dcpromo to demote the DC then run metadata cleanup to make sure the DC fully removed from the domain.

If you can't demote gracefully run dcpromo /forceremoval. Run metadata cleanup.
0
 
Kelly-BradyAuthor Commented:
So I should do this on DC03, which is the new virtual one I just created.
0
 
Darius GhassemCommented:
Yes, DC3 looks like it is having some other issues.
0
 
Kelly-BradyAuthor Commented:
OK so what are the risks of doing this while users are on the network and almost definitely using this server as there login server. All my scopes have this DC listed as their secondary login server.
0
 
Kelly-BradyAuthor Commented:
This is the output of DC03 after I ran the command in an elevated command prompt, so the only issue is the replication issue. Any ideas on how to resolve that?






Microsoft Windows [Version 6.0.6001]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

C:\Windows\system32>dcdiag

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = DC03
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\DC03
      Starting test: Connectivity
         ......................... DC03 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\DC03
      Starting test: Advertising
         ......................... DC03 passed test Advertising
      Starting test: FrsEvent
         ......................... DC03 passed test FrsEvent
      Starting test: DFSREvent
         There are warning or error events within the last 24 hours after the
         SYSVOL has been shared.  Failing SYSVOL replication problems may cause
         Group Policy problems.
         ......................... DC03 failed test DFSREvent
      Starting test: SysVolCheck
         ......................... DC03 passed test SysVolCheck
      Starting test: KccEvent
         ......................... DC03 passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... DC03 passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... DC03 passed test MachineAccount
      Starting test: NCSecDesc
         ......................... DC03 passed test NCSecDesc
      Starting test: NetLogons
         ......................... DC03 passed test NetLogons
      Starting test: ObjectsReplicated
         ......................... DC03 passed test ObjectsReplicated
      Starting test: Replications
         ......................... DC03 passed test Replications
      Starting test: RidManager
         ......................... DC03 passed test RidManager
      Starting test: Services
         ......................... DC03 passed test Services
      Starting test: SystemLog
         ......................... DC03 passed test SystemLog
      Starting test: VerifyReferences
         ......................... DC03 passed test VerifyReferences


   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation

   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation

   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation

   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation

   Running partition tests on : kba
      Starting test: CheckSDRefDom
         ......................... kba passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... kba passed test CrossRefValidation

   Running enterprise tests on : kba.local
      Starting test: LocatorCheck
         ......................... kba.local passed test LocatorCheck
      Starting test: Intersite
         ......................... kba.local passed test Intersite

C:\Windows\system32>
0
 
Darius GhassemCommented:
Those could be old replication issues they stay for 24 hours.

Run Repadmin /syncall
0
 
Kelly-BradyAuthor Commented:
Ok I ran that on all three and dc02 and 03 still show the replication but Dc01 does not, should I just give it time to wsh out from yesterdays upset?
0
 
Darius GhassemCommented:
When you run the above command do you get succesful?
0
 
Kelly-BradyAuthor Commented:
Yes on all the servers it said it was successful.
0
 
Darius GhassemCommented:
Then replication is taking place those errors in the dcdiag were old errors most likely.
0
 
Kelly-BradyAuthor Commented:
Ok I will check it on Monday to make sure so what would be the best way to go from here to get a DC out to my Off site recovery site?
0
 
Darius GhassemCommented:
Sounds good.
0
 
Kelly-BradyAuthor Commented:
Ok so it has setteled down but I am still getting the one error and it seems to be just around the same time every night. So is it safe to remove DC02 from the environment?
0
 
Darius GhassemCommented:
Yes, you should be good to go
0
 
Kelly-BradyAuthor Commented:
So just for me to be clear on this, should I have all my users log off for the weekend then run dcpromo on the machine to just make it a member server. It also is one of the RADIUS servers which I believe is where the role of "Network Policy and Access Services" come from, should I remove this before running dcpromo?
0
 
Darius GhassemCommented:
To be honest I am not for sure on the RADIUS it has been a long time since I worked with this technology
0
 
Kelly-BradyAuthor Commented:
Ok I will have to look into this before I go any farther.
0
 
Kelly-BradyAuthor Commented:
I removed RADIUS and all that is left is the DNS role. I am going to run DCPromo and then leave it as a member server for awhile. I hope that this will allow me to take it off line.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.