Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Group Policy - User Policy not updating for certain DCs

Posted on 2013-01-17
10
Medium Priority
?
672 Views
Last Modified: 2013-03-26
Hello again, all.

I have noticed the GP Event ID 1058 on several machines on our domain.

When executing gpupdate I receive the following:

**************************************
C:\Users\i.mejias>gpupdate
Updating Policy...

User policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows attempted to read the file \\prime.local\SysVol\prime.local\Policies\{038673CC-FC77-446E-8334-D764AFB97F8B}\gpt.ini from a
successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
Computer Policy update has completed successfully.

To diagnose the failure, review the event log or invoke gpmc.msc to access information about Group Policy results.
**************************************

However, the Computer Policy updates just fine.

I also noticed that it is happening when these machines are trying to read the policy template from certain DCs.  For example:

**************************************
C:\>nltest /dsgetdc:prime.local
           DC: \\EXSERVER.prime.local
      Address: \\192.168.123.230
     Dom Guid: d535512a-2942-4417-94f7-9255c0db9fd0
     Dom Name: prime.local
  Forest Name: prime.local
 Dc Site Name: Lewisville
Our Site Name: Lewisville
        Flags: GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE
**************************************

It seems to me that this is an issue of these machines not able to read the gpt.ini from these specific servers.

Thanks in advance!
0
Comment
Question by:IDMA
  • 5
  • 2
10 Comments
 
LVL 17

Expert Comment

by:lruiz52
ID: 38787949
Do you get any other error codes? start with the link below;\

http://technet.microsoft.com/en-us/library/cc727259(v=ws.10).aspx
0
 

Author Comment

by:IDMA
ID: 38788062
Error Code 3.

**************************************
 SupportInfo1 4
  SupportInfo2 840
  ProcessingMode 0
  ProcessingTimeInMilliseconds 2230
  ErrorCode 3
  ErrorDescription The system cannot find the path specified.  
  DCName exserver.prime.local
  GPOCNName cn={038673CC-FC77-446E-8334-D764AFB97F8B},cn=policies,cn=system,DC=prime,DC=local
  FilePath \\prime.local\SysVol\prime.local\Policies\{038673CC-FC77-446E-8334-D764AFB97F8B}\gpt.ini
**************************************

However, the above result is from one server throwing the error BUT, from my machine (a regular laptop) I don't see it and it is connecting to the same DC (EXSERVER):

C:\>nltest /dsgetdc:prime.local
           DC: \\EXSERVER.prime.local
      Address: \\192.168.123.230
     Dom Guid: d535512a-2942-4417-94f7-9255c0db9fd0
     Dom Name: prime.local
  Forest Name: prime.local
 Dc Site Name: Lewisville
Our Site Name: Lewisville
        Flags: GC DS LDAP KDC TIMESERV WRITABLE DNS_DC DNS_DOMAIN DNS_FOREST CLOSE_SITE
The command completed successfully
*************************************

What I am having trouble with is, understanding why gpupdate would work from my laptop and other users that are connecting to EXSERVER; and not this machine.
0
 

Author Comment

by:IDMA
ID: 38801962
UPDATE:
After rebooting EXSERVER, this resolved part of the issue.  Now, on DC DEVILS (PRC), I keep seeing Event ID 1058 non-stop.

*****************
The processing of Group Policy failed. Windows attempted to read the file \\prime.local\SysVol\prime.local\Policies\{B8016FE8-A031-4BD2-A913-76746479E7AD}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
******************
+ System

  - Provider

   [ Name]  Microsoft-Windows-GroupPolicy
   [ Guid]  {AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}
 
   EventID 1058
 
   Version 0
 
   Level 2
 
   Task 0
 
   Opcode 1
 
   Keywords 0x8000000000000000
 
  - TimeCreated

   [ SystemTime]  2013-01-21T17:08:21.869283200Z
 
   EventRecordID 37479
 
  - Correlation

   [ ActivityID]  {634F57CA-2717-4797-8CB1-3FB3028BD052}
 
  - Execution

   [ ProcessID]  900
   [ ThreadID]  1336
 
   Channel System
 
   Computer devils.prime.local
 
  - Security

   [ UserID]  S-1-5-18
 

- EventData

  SupportInfo1 4
  SupportInfo2 816
  ProcessingMode 0
  ProcessingTimeInMilliseconds 703
  ErrorCode 3
  ErrorDescription The system cannot find the path specified.  
  DCName exserver.prime.local
  GPOCNName cn={B8016FE8-A031-4BD2-A913-76746479E7AD},cn=policies,cn=system,DC=prime,DC=local
  FilePath \\prime.local\SysVol\prime.local\Policies\{B8016FE8-A031-4BD2-A913-76746479E7AD}\gpt.ini
0
Veeam Disaster Recovery in Microsoft Azure

Veeam PN for Microsoft Azure is a FREE solution designed to simplify and automate the setup of a DR site in Microsoft Azure using lightweight software-defined networking. It reduces the complexity of VPN deployments and is designed for businesses of ALL sizes.

 

Author Comment

by:IDMA
ID: 38805771
Alright, just realized that the C:\Windows\SYSVOL\domain\Policies from the PDC is not replicating to the other DCs.  ANy suggestions?
0
 
LVL 37

Expert Comment

by:ArneLovius
ID: 38808281
How many subnets/VLANS are the DC's spread over ?

Are you running IPv6 in any subnets ?

Are all of the DCs in the domain 2k8 ?
0
 

Author Comment

by:IDMA
ID: 38808301
Thanks -

6 subnets
No IPv6 anywhere
There are 2 or 3 2k3 R2 DCs left
0
 
LVL 37

Accepted Solution

by:
ArneLovius earned 1000 total points
ID: 38808316
run replmon from the 2k3 support tools on one of the 2k3 DCs, add all of the DCs

its a much better (IMHO) interface than repadmin for finding out where failure are occurring.

http://technet.microsoft.com/en-us/library/cc784128(v=ws.10).aspx

Are the six subnets in the same site ? are there any firewalls or VPN connections between the subnets ?

The IPv6 question was in case you had IPv6 in some subnets, but no IPv6 routing between them.
0
 

Author Comment

by:IDMA
ID: 38822667
Each subnet represents a different satellite office, so they are remote locations; end they are connecting through a dedicated VPN tunnel.

Thanks.  I have run the replmon tool and several 1722 errors and also can see that in 4 DCs several policies have an X next to them.
0

Featured Post

 [eBook] Windows Nano Server

Download this FREE eBook and learn all you need to get started with Windows Nano Server, including deployment options, remote management
and troubleshooting tips and tricks

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scenario:  You do full backups to a internal hard drive in either product (SBS or Server 2008).  All goes well for a very long time.  One day, backups begin to fail with a message that the disk is full.  Your disk contains many, many more backups th…
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…
Suggested Courses

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question