Active Directory

InSearchOf
InSearchOf used Ask the Experts™
on
I was looking at our AD servers as I just took them over from a previous administrator and things look a bit of a mess. First off I ran the best practice analyzer on AD Domain Services and got a couple of critical errors. I attached the screenshot. We are running Win 2008 R2. We have a number of DCs. Can this be resolved without any impact?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
FOXActive Directory/Exchange Engineer
Top Expert 2015

Commented:
Screenshot is not attached
InSearchOfIT Director

Author

Commented:
Ooops. Sorry about that.
ad-best-practice.docx
FOXActive Directory/Exchange Engineer
Top Expert 2015

Commented:
Those are the only 2 errors you have?  The first one is pretty self explanatory.  I would first check to see if Deny Access to this computer is set to Everyone.  If it isn't then grant access to this computer from the network to the groups it has mentioned. For your second error I would run a gpupdate /force on that server with a reboot.
Should you be charging more for IT Services?

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

InSearchOfIT Director

Author

Commented:
I was able to resolve the first error. But not the second because I do not see a "Default Domain Controller Policy"
FOXActive Directory/Exchange Engineer
Top Expert 2015

Commented:
Open Group Policy Management on one of your DCs and expand Group Policy Objects and you will see it there.
It is suppose to be linked to the Domain Controllers OU as well
InSearchOfIT Director

Author

Commented:
Aha. It says its linked so why do I get the the error?
FOXActive Directory/Exchange Engineer
Top Expert 2015

Commented:
do a gpupdate /force from an elevated command line and then reboot.
InSearchOfIT Director

Author

Commented:
When I expand the Domain Controller OU in GPMC I see the "Domain Controllers Policy" gpo is linked
FOXActive Directory/Exchange Engineer
Top Expert 2015

Commented:
Yes you mentioned that. I assume that DC is in the Domain Controller OU as well.  On that DC that has that error, open an elevated command prompt   gpupdate /force.    Then do a reboot  on it.
InSearchOfIT Director

Author

Commented:
Sorry I got wrong. There is no "Default Domain Controller Policy" in GP objects. It looks like someone replaced it or renamed with "Domain Controllers Policy"
Active Directory/Exchange Engineer
Top Expert 2015
Commented:
1. In Group Policy Management verify what Group Policy is linked to the Domain Controllers OU
2. Find a functional domain controller and verify what groups it belongs to
3. Set the domain controller that is faulting out to the same group memberships and remove any that don't match the functional one.
4.  As stated above, run a gpupdate /force on the domain controller in question and reboot.
InSearchOfIT Director

Author

Commented:
I will do a gpupdate /f with a reboot after hours. I do not want to do it during production.
InSearchOfIT Director

Author

Commented:
All my DCs are flagging the same error
FOXActive Directory/Exchange Engineer
Top Expert 2015

Commented:
Link the Default domain controller policy to the domain controller OU

https://technet.microsoft.com/en-us/library/ff646920(v=ws.10).aspx
InSearchOfIT Director

Author

Commented:
Like I said there is no default controller policy. It is not there
InSearchOfIT Director

Author

Commented:
I tried the gpupdate /f with a reboot and still get the same error complaining about the "Default Controllers Policy" not being applied to the "Domain Controllers OU" when I run the Best Practice. When I go to the "Domain Controllers" OU in the GPMC I have a "Domain Controllers Policy" gpo linked.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial