Solved

GPs are reading as inaccessible

Posted on 2016-08-19
7
38 Views
Last Modified: 2016-08-20
Environment is two 2012 DCs at 2008 R2 Forest and domain functional level.

All of my group policies are showing inaccessible.  Even new ones I create and scoped to OUs and users.  

The two DCs replicate fine.  Permissions on the sysvol have not changed.  I checked permissions and they are as they should be.  

The network has been static for some time now.  No new software, new hardware, nothing.

I'm checking even logs now but was hoping for some ideas on where to look.

Thanks

Cliff

PS: name of the policy is showing as GUID, not policy name.  I have found numerous posts around the net but none of those fixes worked.
0
Comment
Question by:crp0499
7 Comments
 
LVL 15

Expert Comment

by:WalkaboutTigger
ID: 41763297
What, if any, errors do you receive when you perform a gpupdate /force from a workstation or server?
0
 

Author Comment

by:crp0499
ID: 41763302
It reports a successful update.

I am seeing in the log, two things.  One is that the network path is inaccessible

and I see network sharing is not turned on and when I turn it on, it goes right back off.
0
 
LVL 4

Expert Comment

by:david_tocker
ID: 41763542
Sounds like you have a Journal wrap error.
Check the File Replication Service log on your domain controller(s) and you may need to follow the steps below to restore replication for your group policy objects which are stored on the netlogon volume:

https://support.microsoft.com/en-nz/kb/290762
0
Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

 
LVL 18

Accepted Solution

by:
Sushil Sonawane earned 500 total points
ID: 41763560
Please check on GP user might be having read deny permission due to user not able to read GPO name correctly.

Also check on client system policy working fine or not.
0
 
LVL 1

Expert Comment

by:saumik belel
ID: 41763583
It's been how many days you have restarted your domain controllers.

Kindly check for error events in event-viewer- File replication services.  

Also run Dcdiag /test:dns & let us know the result.
0
 

Author Closing Comment

by:crp0499
ID: 41763608
That was it.  Somehow, the authenticated users group no longer had read permissions on the GPs.
0
 
LVL 1

Expert Comment

by:saumik belel
ID: 41763609
Check the Status of the SYSVOL and Netlogon Shares

1. On the Start menu, point to Administrative Tools, and then click Services.

2. Verify that the DFS Replication service and the Netlogon service have a status of Started. If a service is stopped, click Restart.

3. Open a Command Prompt as an administrator: On the Start menu, right-click Command Prompt, and then click Run as administrator. If the User Account Control dialog box appears, provide Domain Admins credentials, if required, and then click Continue.

4.To verify that the SYSVOL tree includes the sysvol and scripts shared folders, at the command prompt, type the following command, and then press ENTER:
net share

5. Check the list to be sure that it includes %systemroot%\SYSVOL\sysvol\ (the SYSVOL share) and %systemroot%\SYSVOL\sysvol\<Domain Name>\SCRIPTS (the NETLOGON share), where <Domain Name> is the domain of the new domain controller.

Note:
If neither %systemroot%\SYSVOL\sysvol\ nor %systemroot%\SYSVOL\sysvol\<Domain Name>\SCRIPTS are present, see Verify Active Directory Replication.

6. Verify that the proper permissions are set for SYSVOL replication. At the command prompt, type the following command, and then press ENTER:
dcdiag /test:netlogons
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
Is your Office 365 signature not working the way you want it to? Are signature updates taking up too much of your time? Let's run through the most common problems that an IT administrator can encounter when dealing with Office 365 email signatures.
This tutorial will give a an overview on how to deploy remote agents in Backup Exec 2012 to new servers. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as connecting to a remote Back…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

895 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now