SysAdmin
asked on
List of applicable group policy objects continues to change...
I have 8 Group Policy Objects that I apply to an OU.
When I look at the GroupPolicy event logs, specifically Event ID 5312 that shows applicable Group Policy Objects, it continuously changes.
One minute I will see all 8 applied like this:
The next minute I look I only see 3 applied like this:
When I view this specific eventID, sort, I can see the change sometimes happening within 2 minutes. Almost like it's "flapping" so to speak.
Can anyone provide insight on this? I have 4 domain controllers in 1 forrest.
Thank you in advance.
When I look at the GroupPolicy event logs, specifically Event ID 5312 that shows applicable Group Policy Objects, it continuously changes.
One minute I will see all 8 applied like this:
List of applicable Group Policy objects:
GPO-1
GPO-2
GPO-3
GPO-4
GPO-5
GPO-6
GPO-7
GPO-8The next minute I look I only see 3 applied like this:
List of applicable Group Policy objects:
GPO-1
GPO-2
GPO-3When I view this specific eventID, sort, I can see the change sometimes happening within 2 minutes. Almost like it's "flapping" so to speak.
Can anyone provide insight on this? I have 4 domain controllers in 1 forrest.
Thank you in advance.
ASKER
@McKnife
I have attached a PDF of a bunch of event IDs 5312 so you can see timestamps and where things get weird where it's less than the default refresh. I then attached all details of event ID in order of time so you can see.
I have invoked the gpudate /force.
I have not been able to get both gpresult /h with policies applied and without but I have attached a PDF of the 5312 event ID's.
One other thing I noticed is when I only have the 3 GPO's applied on eventID 5312 the next eventID 5313 states the local group policy "not applied (Empty). Not sure if that has something to do with it or not.
Thank you for any help you can provide.
I have attached a PDF of a bunch of event IDs 5312 so you can see timestamps and where things get weird where it's less than the default refresh. I then attached all details of event ID in order of time so you can see.
I have invoked the gpudate /force.
I have not been able to get both gpresult /h with policies applied and without but I have attached a PDF of the 5312 event ID's.
One other thing I noticed is when I only have the 3 GPO's applied on eventID 5312 the next eventID 5313 states the local group policy "not applied (Empty). Not sure if that has something to do with it or not.
Thank you for any help you can provide.
ASKER
OK -- I think I am reading the logs wrong.
When I did a gpresult /h when it showed only the 3 applicable GPOs, all my others were still there.
When I did a gpresult /h when it showed only the 3 applicable GPOs, all my others were still there.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks for your help I appreciate it very much!
ASKER
McKnife was very helpful in coming up with a solution, looked at some of my logs, and even compared them to his own machine to help out.
That's why I would like to ask you:
-did you modify the default refresh interval?
-did you invoke a refresh on the command line (gpupdate /force)?
You should also compare the gpresults /h output at different times and share that here, since that is what matters.