GPO Failures on Member Servers



In one of our domains I have member servers failing GPO updates and the
winlogon.log file is showing failures on:

%SYSVOL%\DOMAIN\POLICIES....

We had this on the domain controller as well, and the documentation online
suggests that this error happens when you apply the basicdc GPO template,
which uses some environment variables that only exist during a dcpromo.
You define those three variables and the errors go away. I did define
them, and the errors did go away.

But I am completely perplexed why are we getting the same error now on
*member servers*. No way did anyone apply a basicdc GPO template to those.
But to be sure I applied a hisecws template to the local policy, then
applied the same template to the Default Domain Policy on the domain
controller. THe member server still gets this error that only makes sense
in the context of a domain controller. The member server's winlogon.log
contains the "%SYSVOL\DOMAIN\POLICIES" reference.

I don't really want to hack up environment variables for some policy that
makes no sense in the context of a member server. How do I find the exact
policies that contain this wrong reference, and even better is there a way
to just wipe out both the local policy and domain member server GPO policy
and start over from scratch?

--
Will


.



Relevant Pages

  • Re: GPO - Access denied after changing a GP setting
    ... You are about to restore Default Domain policy and Default domain Controller po ... This may render some server applications to fail. ... Unable to open the GPO due to access denied. ... You are about to restore Default Domain controller policy for the following domain ...
    (microsoft.public.windows.server.security)
  • Re: GPO - Access denied after changing a GP setting
    ... This may render some server applications to fail. ... y Unable to open the GPO due to access denied. ... This tool was unable to re-create the EFS Certificates in the Default D omain Policy GPO Access is denied. ... You are about to restore Default Domain controller policy for the following domain Do you want to continue: ...
    (microsoft.public.windows.server.security)
  • Re: I need a little IPSec help, please.
    ... PC is a member server. ... "Server " default IPSec policy. ... create a new Group Policy Object underneath the Default Domain Controller ...
    (microsoft.public.cert.exam.mcsa)
  • Re: Help with GPO problem!! PLEASE!!
    ... > Reposting as we tried in the GPO thread, but after an exhausted attempt, I ... I am racking my brain on this problem with a Windows 2003 Standard ... > Controller Security Policy or the GPO. ... > Domain Controller Security Policy: Failed to open the Group Policy Object. ...
    (microsoft.public.windows.server.active_directory)
  • I need a little IPSec help, please.
    ... PC is a member server. ... "Server " default IPSec policy. ... create a new Group Policy Object underneath the Default Domain Controller ...
    (microsoft.public.cert.exam.mcsa)

Loading