Solved

Mapped drives inaccessible, Group policy not updating. \\Sysvol unreachable - not sure what to ask actually

Posted on 2016-11-10
55
20 Views
Last Modified: 2016-11-15
OS = Win2008 server standard

I have a new situation where my workstation drives,  mapped to a NAS, are becoming unreachable. When I try to open them it says something like that network name is in use. Figuring it would resolve with a reboot, I did to find I had 2 servers (both the DC's) return the following error message upon reboot and attempt to logon.
"the trust relationship between this workstation and the primary domain failed"

Game on! I located a Netdom command that restored the trust credential so I can logon again. But I found that group policy was not being done. none of the mapped drives showed up on these servers.

Typing \\sysvol fails, typing \\servername\sysvol works to show the files within.
Net Share shows NETLOGON and SYSVOL
 
Opening \windows\Sysvol\sysvol on the 2 DC's showed that there was a file missing from one of them, so I copied it there and ran GPupdate /force - this restored the mapped drives after a logon cycle

DCDIAG
Starting test: NCSecDesc
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes In Filtered Set  access rights for the naming context:
         DC=DomainDnsZones,DC=MyDomain
         Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have Replicating Directory Changes In Filtered Set  access rights for the naming context:
         DC=ForestDnsZones,DC=MyDomain
         .........................DC2 failed test NCSecDesc
and several instances of this

An error event occurred.  EventID: 0x00000422
            Time Generated: 11/10/2016   13:19:04
            Event String:
            The processing of Group Policy failed. Windows attempted to read the file \\MyDomain\SysVol\MyDomain\Policies\{A10EF782-04C8-4AD7-B796-A527A4FABF12}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

I'm not sure where to go with this, All the solutions I look up don't have Netlogon and Sysvol showing under net share and I have those.
I also changed a registry parameter for BurFlag to d4 and that made no difference either.

After coping the files to make Sysvol the same on both DC's my mapped drives appeared on logon and are are there a couple hours later, but I don't think I can count on this staying this way. There seems to be something lurking
What am I looking for in a case like this?
0
Comment
Question by:Salad-Dodger
  • 29
  • 26
55 Comments
 
LVL 6

Expert Comment

by:No More
ID: 41883041
Could you run DFSDIAG /testdcs

Repadmin /showrepl

It looks like replication issue between DC's
0
 
LVL 6

Expert Comment

by:No More
ID: 41883046
Also, I would point to DNS for being possible problem of this
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883047
Ran DFSDIAG on one DC and all the results came back OK, showed both machines and each was compared to the other and OK

on the second machine, DFSDIAG was not recognized as a valid exe,  ???
0
 
LVL 6

Assisted Solution

by:No More
No More earned 500 total points
ID: 41883052
That's because you don't have DFS snap in installed on other server

could you run DCDiag /e
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883056
DNS I saw a lot in my search, but nothing I can see is wrong with DNS. no weird or duplicate IP's.
The machine that ran DFSDIAG has entries saying the DNS updated its own records while the second says DNS is waiting for AD DS signal that sync has completed.
0
 
LVL 6

Assisted Solution

by:No More
No More earned 500 total points
ID: 41883058
Run this and tell me output
dfsrdiag ReplicationState /all
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883065
DFSRDIAG Results
DC2 has all zeros
DC1 doesn't recognize the argument ReplicationState

(I thought these were the same OS, but DC2 is Server 2008 R2 and DC1 is not R2)

attached is the DCDiag /e from each machine
DC1.txt
DC2.txt
0
 
LVL 6

Expert Comment

by:No More
ID: 41883068
You know what i get the feeling that DC1is using FSR and DC2 is using DFS
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883070
Because of the OS difference? or is there something I can do to make them both DFS. Its a Dell 2950 so its more than due fro replacement, but I'd like to get it stable first.
0
 
LVL 6

Expert Comment

by:No More
ID: 41883084
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883113
The Article says its not important if you don't want to implement an RODC, which I don't.  But doing so made those 2 errors go away
I found that DC2 does not have File services Role enabled. Thats DFS right?
0
 
LVL 6

Expert Comment

by:No More
ID: 41883124
File services Role includes multiple different services and also DFS

What errors are you getting now ?
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883128
Event log entries of 1058 Group policy attempted to read the file . . . . on both machines
0
 
LVL 6

Expert Comment

by:No More
ID: 41883131
Could you post whole error from event log  ???
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883137
Log Name:      System
Source:        Microsoft-Windows-GroupPolicy
Date:          11/10/2016 5:01:25 PM
Event ID:      1058
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      DC1.MyDomain
Description:
The processing of Group Policy failed. Windows attempted to read the file \\MyDomain\SysVol\MyDomain\Policies\{A10EF782-04C8-4AD7-B796-A527A4FABF12}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: 
a) Name Resolution/Network Connectivity to the current domain controller. 
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). 
c) The Distributed File System (DFS) client has been disabled.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}" />
    <EventID>1058</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>1</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2016-11-11T01:01:25.044Z" />
    <EventRecordID>19448</EventRecordID>
    <Correlation ActivityID="{DC480DAD-1A4E-4746-956A-2B3D486E858E}" />
    <Execution ProcessID="1024" ThreadID="3100" />
    <Channel>System</Channel>
    <Computer>DC1.MyDomain</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="SupportInfo1">4</Data>
    <Data Name="SupportInfo2">840</Data>
    <Data Name="ProcessingMode">0</Data>
    <Data Name="ProcessingTimeInMilliseconds">2184</Data>
    <Data Name="ErrorCode">2</Data>
    <Data Name="ErrorDescription">The system cannot find the file specified. </Data>
    <Data Name="DCName">DC1</Data>
    <Data Name="GPOCNName">cn={A10EF782-04C8-4AD7-B796-A527A4FABF12},cn=policies,cn=system,DC=MyDomain</Data>
    <Data Name="FilePath">\\MyDomain\SysVol\MyDomain\Policies\{A10EF782-04C8-4AD7-B796-A527A4FABF12}\gpt.ini</Data>
  </EventData>
</Event>

Open in new window

0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883139
I am under the impression I should be able to type \\sysvol into explorer and have that folder open up. Am I wrong?
0
 
LVL 6

Expert Comment

by:No More
ID: 41883140
Have you been doing any changes to Default Domain Policy GPO ?


Run this on DC1
dcgpofix /target:Domain
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883147
Yes, but not recently and certainly nothing I cant reimplement
Ran the command and it threw the error
The AD Schema version for this domain and the version supported by this tool do not match... 

Open in new window

Gave a /ignoreschema workaround but didnt recommend it.
0
 
LVL 6

Assisted Solution

by:No More
No More earned 500 total points
ID: 41883148
dcgpofix /ignoreschema /target:Domain
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883151
Is there a risk here?
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883153
If I run this on DC2 I get no such error. There is a version difference. What kind of failure can I expect if this goes bad?
0
 
LVL 6

Expert Comment

by:No More
ID: 41883154
No
0
 
LVL 6

Expert Comment

by:No More
ID: 41883155
Why did you run it on DC2 ? Just correct me if I'm wrong DC1 is your primary DC ? which is 2008, DC2 is 2008r2
0
 
LVL 6

Expert Comment

by:No More
ID: 41883156
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883157
I ran it on DC2 to the Y/N point to see if it would complain, I didn't execute it completely on DC2.
I just now ran it on DC1
0
 
LVL 6

Expert Comment

by:No More
ID: 41883159
run gpupdate and tell me if you get any error
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883161
Same Error - - - Shoot, I was hopeful.
0
Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

 
LVL 6

Expert Comment

by:No More
ID: 41883163
NET STOP NTFRS

NET START NTFRS


And wait for error in event log for File Replication Service
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883174
On DC1 right?
Stopped, started and Event log says "... no longer preventing DC1 from becoming a Domain Controller...."

but it has several entries like that prior to this one.
I'm watching it for a new entry.
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883175
GPupdate still failed BTW
0
 
LVL 6

Assisted Solution

by:No More
No More earned 500 total points
ID: 41883181
run
Repadmin /showreps

and post output
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883187
C:\Windows\System32>repadmin /showreps
Default-First-Site-Name\DC1
DSA Options: IS_GC
Site Options: (none)
DSA object GUID: 86dda898-7ce5-4cb5-b092-2f7faf0c37bb
DSA invocationID: 86dda898-7ce5-4cb5-b092-2f7faf0c37bb

==== INBOUND NEIGHBORS ======================================

DC=MyDomain
    Default-First-Site-Name\DC2 via RPC
        DSA object GUID: b7ed0490-cbad-4829-9b6c-552e54d3a66f
        Last attempt @ 2016-11-10 18:00:18 was successful.

CN=Configuration,DC=MyDomain
    Default-First-Site-Name\DC2 via RPC
        DSA object GUID: b7ed0490-cbad-4829-9b6c-552e54d3a66f
        Last attempt @ 2016-11-10 18:04:15 was successful.

CN=Schema,CN=Configuration,DC=MyDomain
    Default-First-Site-Name\DC2 via RPC
        DSA object GUID: b7ed0490-cbad-4829-9b6c-552e54d3a66f
        Last attempt @ 2016-11-10 17:50:53 was successful.

DC=DomainDnsZones,DC=MyDomain
    Default-First-Site-Name\DC2 via RPC
        DSA object GUID: b7ed0490-cbad-4829-9b6c-552e54d3a66f
        Last attempt @ 2016-11-10 17:50:53 was successful.

DC=ForestDnsZones,DC=MyDomain
    Default-First-Site-Name\DC2 via RPC
        DSA object GUID: b7ed0490-cbad-4829-9b6c-552e54d3a66f
        Last attempt @ 2016-11-10 17:50:53 was successful.

C:\Windows\System32>

Open in new window

0
 
LVL 6

Expert Comment

by:No More
ID: 41883188
BTW was it:

Event ID 13515

The File Replication Service is no longer preventing the computer DC1 from becoming a domain controller ?
0
 
LVL 6

Expert Comment

by:No More
ID: 41883195
Type "net share" to check for the SYSVOL share
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883196
Log Name:      File Replication Service
Source:        NtFrs
Date:          11/10/2016 5:50:28 PM
Event ID:      13516
Task Category: None
Level:         Information
Keywords:      Classic
User:          N/A
Computer:      DC1.MyDomain
Description:
The File Replication Service is no longer preventing the computer DC1 from becoming a domain controller. The system volume has been successfully initialized and the Netlogon service has been notified that the system volume is now ready to be shared as SYSVOL. 
 
Type "net share" to check for the SYSVOL share.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="NtFrs" />
    <EventID Qualifiers="16384">13516</EventID>
    <Level>4</Level>
    <Task>0</Task>
    <Keywords>0x80000000000000</Keywords>
    <TimeCreated SystemTime="2016-11-11T01:50:28.000Z" />
    <EventRecordID>28</EventRecordID>
    <Channel>File Replication Service</Channel>
    <Computer>DC1.MyDomain</Computer>
    <Security />
  </System>
  <EventData>
    <Data>DC1</Data>
  </EventData>
</Event>

Open in new window

0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883200
C:\Windows\System32>net share

Share name   Resource                        Remark

-----------------------------------------------------------------------
C$           C:\                             Default share
D$           D:\                             Default share
print$       C:\WINDOWS\system32\spool\drivers
                                             Printer Drivers
IPC$                                         Remote IPC
ADMIN$       C:\Windows                      Remote Admin
iFIX         C:\Program Files\GE Fanuc\Proficy iFIX

NETLOGON     C:\WINDOWS\SYSVOL\sysvol\MyDomain\SCRIPTS
                                             Logon server share
SCADA        D:\SCADA                        Shared SCADA Directory
ScadaFiles   D:\SCADA
SYSVOL       C:\WINDOWS\SYSVOL\sysvol        Logon server share
The command completed successfully.

Open in new window

0
 
LVL 6

Expert Comment

by:No More
ID: 41883205
Just a quick question do you have "BurFlags"  set to D4 ?
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883207
Yes.
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883208
I stand corrected - I set it there previously but it is currently set to Zero
0
 
LVL 6

Expert Comment

by:No More
ID: 41883210
Have you any problems accessing sysvol or netlogon share, are there any new errors in event log ?
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883214
typing "\\sysvol" in explorer fails to list contents
typing "\\DC1\sysvol" shows folder contents
typing "\\DC2\sysvol" shows folder contents
But GPupdate fails
I think I should be able to type simply "\\sysvol" and have it show the contents of the folder. Am I right?
I also think thats what GPupdate is looking for..."\\sysvol". Which is why I keep bringing it up.

BTW I appreciate you hanging with me this long. I'm gone the next 4 days and it would be great to put this behind me.
0
 
LVL 6

Assisted Solution

by:No More
No More earned 500 total points
ID: 41883215
\\sysvol - no this way it wont work


Can you post the error with gpupdate >



Could you run Dcdiag /e /test:sysvolcheck /test:advertising
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883221
C:\Windows\System32>gpupdate
Updating Policy...

User policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows attempted to read the file \\MyDomain\SysVol\MyDomain\Policies\{A10EF782-04C8-4AD7-B796-A527A4FABF12}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated
to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
Computer policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows attempted to read the file \\MyDomain\SysVol\MyDomain\Policies\{A10EF782-04C8-4AD7-B796-A527A4FABF12}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated
to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

To diagnose the failure, review the event log or invoke gpmc.msc to access information about Group Policy results.

Open in new window

C:\Windows\System32>Dcdiag /e /test:sysvolcheck /test:advertising

Directory Server Diagnosis

Performing initial setup:
   Trying to find home server...
   Home Server = DC1
   * Identified AD Forest.
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site-Name\DC1
      Starting test: Connectivity
         ......................... DC1 passed test Connectivity

   Testing server: Default-First-Site-Name\DC2
      Starting test: Connectivity
         ......................... DC2 passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site-Name\DC1
      Starting test: Advertising
         ......................... DC1 passed test Advertising
      Starting test: SysVolCheck
         ......................... DC1 passed test SysVolCheck

   Testing server: Default-First-Site-Name\DC2
      Starting test: Advertising
         ......................... DC2 passed test Advertising
      Starting test: SysVolCheck
         ......................... DC2 passed test SysVolCheck



   Running partition tests on : ForestDnsZones

   Running partition tests on : DomainDnsZones

   Running partition tests on : Schema

   Running partition tests on : Configuration

   Running partition tests on : MyDomain

   Running enterprise tests on : MyDomain

C:\Windows\System32>

Open in new window

Log Name:      System
Source:        Microsoft-Windows-GroupPolicy
Date:          11/10/2016 6:39:06 PM
Event ID:      1058
Task Category: None
Level:         Error
Keywords:      
User:          SYSTEM
Computer:      DC1.MyDomain
Description:
The processing of Group Policy failed. Windows attempted to read the file \\MyDomain\SysVol\MyDomain\Policies\{A10EF782-04C8-4AD7-B796-A527A4FABF12}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: 
a) Name Resolution/Network Connectivity to the current domain controller. 
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). 
c) The Distributed File System (DFS) client has been disabled.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{aea1b4fa-97d1-45f2-a64c-4d69fffd92c9}" />
    <EventID>1058</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>0</Task>
    <Opcode>1</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2016-11-11T02:39:06.786Z" />
    <EventRecordID>19492</EventRecordID>
    <Correlation ActivityID="{2888186F-0506-4AC1-99A7-DE56A77C709A}" />
    <Execution ProcessID="1024" ThreadID="3100" />
    <Channel>System</Channel>
    <Computer>DC1.MyDomain</Computer>
    <Security UserID="S-1-5-18" />
  </System>
  <EventData>
    <Data Name="SupportInfo1">4</Data>
    <Data Name="SupportInfo2">840</Data>
    <Data Name="ProcessingMode">0</Data>
    <Data Name="ProcessingTimeInMilliseconds">2184</Data>
    <Data Name="ErrorCode">2</Data>
    <Data Name="ErrorDescription">The system cannot find the file specified. </Data>
    <Data Name="DCName">DC1</Data>
    <Data Name="GPOCNName">cn={A10EF782-04C8-4AD7-B796-A527A4FABF12},cn=policies,cn=system,DC=MyDomain</Data>
    <Data Name="FilePath">\\MyDomain\SysVol\MyDomain\Policies\{A10EF782-04C8-4AD7-B796-A527A4FABF12}\gpt.ini</Data>
  </EventData>
</Event>

Open in new window

0
 
LVL 6

Assisted Solution

by:No More
No More earned 500 total points
ID: 41883228
ntfrsutl forcerepl DC1.domain.local /r "domain system volume (sysvol share)" /p DC2.domain.local

Run this on DC1, this will replicate from dc2
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883236
It ran, what should I look for as a result?
No errors thrown, but GPUPDATE still fails with the same error message
0
 
LVL 6

Expert Comment

by:No More
ID: 41883238
LocalComputerName = contosodc1
ReplicaSetGuid = (null)
CxtionGuid = (null)
ReplicaSetName = domain system volume (sysvol share)
PartnerDnsName = ContosoDC2.Contoso.com


DC2 do

NET STOP NTFRS

NET START NTFRS

and check event log there
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883240
The error message is looking for a GPT.ini ? I went to the folder its references and there are templates, but no GPT.ini. There isn't one in  several I looked at but there are in others
0
 
LVL 6

Expert Comment

by:No More
ID: 41883245
File Replication Service event


Which of DC's doesn't have gpt.ini ?
0
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883248
Same 13516 as before... What about the missing GPT.INI file?
0
 
LVL 6

Expert Comment

by:No More
ID: 41883252
Does it says DC1 in event log on DC2 ?



Check for missing gpt.ini on domain controllers using his path   C:\Windows\SYSVOL\domain\Policies
0
 
LVL 1

Assisted Solution

by:Salad-Dodger
Salad-Dodger earned 0 total points
ID: 41883253
YES!!!! I made a simple change to the GPO referenced by the error message GUID and saved.
This created the GPT.INI and the GPUPDATE RAN !!
0
 
LVL 1

Accepted Solution

by:
Salad-Dodger earned 0 total points
ID: 41883259
That's just what I did, it was missing from both DC's. I used the GUID in the error message and was able to find that GUID in the GPME and simply changes it a litle so it would save again.

When I made the edit and saved it was sent to both DC's instantly.  I guess that means replication is working too.
0
 
LVL 6

Expert Comment

by:No More
ID: 41883262
Epic 3:24am, glad it's fixed
1
 
LVL 1

Author Comment

by:Salad-Dodger
ID: 41883268
I really appreciate your help.
0
 
LVL 1

Author Closing Comment

by:Salad-Dodger
ID: 41887629
Dumb luck on my part that I stumbled onto it, but David kept trying new things and stuck with me the whole time so he gets the points.
I learned a lot on this one.
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

In this article, we will see the basic design consideration while designing a Multi-tenant web application in a simple manner. Though, many frameworks are available in the market to develop a multi - tenant application, but do they provide data, cod…
Disabling the Directory Sync Service Account in Office 365 will stop directory synchronization from working.
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now