Re: GPOs cannot be saved because files being used by another proce

Hi,

Thanks for quick reply. I tried to make those test and results are listed
below:

UItrasound fails to install WMI to DC that the software is running but is
able to install to remote DC. I tried to fix it obeying
http://www.talkaboutsoftware.com/group/microsoft.public.windows.server.dfs_frs/messages/322.html
but the add user / group boxes are grey and cannot be pressed. Those msi and
log files do not exist in the file system, but adding those manually from
installation directory did not make it any better.

Install (queued) 0 Could not launch -- C:\WINDOWS\system32\msiexec.exe /i
C:\WINDOWS\USProvider.msi ALLUSERS=1 CONTROLLERACCOUNT=NEW_SRV4$@mydomain.com
/l*v C:\WINDOWS\USProvider.log /qn. On Server = NEW_srv4.mydomain.com.
Return code = 3 10.8.2006 8:39:00 <not set> 0 00:00:00 0 bytes 3 1

However, SONAR didn't find any problems at all.

FRSDiag founds a lot of errors (low disk space has, of course, been fixed):
****************

NEW Win 2003 R2 DC NEW_srv5

Checking for errors/warnings in FRS Event Log ....
NtFrs 2.8.2006 15:28:30 Error 13504 The File Replication Service stopped
without cleaning up.
......... failed 1
Checking for errors in Directory Service Event Log .... passed
Checking for minimum FRS version requirement ... passed
Checking for errors/warnings in ntfrsutl ds ... passed
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size... passed
Checking Overall Disk Space and SYSVOL structure (note: integrity is not
checked)... passed
Checking for suspicious inlog entries ... passed
Checking for suspicious outlog entries ...
ERROR: 48,78% (20 out of 41) of your outlog contains Security ACL events.
See KB articles below for further information:
279156 - The Effects of Setting the File System Policy on a Disk Drive or
Folder
284947 - Antivirus Programs May Modify Security Descriptors and Cause
Excessive Replication of FRS Data in Sysvol and DFS
......... failed
Checking for appropriate staging area size ... passed
Checking for errors in debug logs ...
ERROR on NtFrs_0001.log : "ERROR_ACCESS_DENIED" : <SndCsMain:
2624: 904: S0: 16:00:38> :SR: Cmd 011194e0, CxtG 4258a0e0, WS
ERROR_ACCESS_DENIED, To OLD_srv2.mydomain.com Len: (368) [SndFail - Send
Penalty]
ERROR on NtFrs_0001.log : "ERROR_ACCESS_DENIED" : <SndCsMain:
4544: 877: S0: 16:00:38> :SR: Cmd 01107c68, CxtG ade30102, WS
ERROR_ACCESS_DENIED, To OLD_srv2.mydomain.com Len: (570) [SndFail - rpc
call]
ERROR on NtFrs_0001.log : "ERROR_ACCESS_DENIED" : <SndCsMain:
4544: 904: S0: 16:00:38> :SR: Cmd 01107c68, CxtG ade30102, WS
ERROR_ACCESS_DENIED, To OLD_srv2.mydomain.com Len: (570) [SndFail - Send
Penalty]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
Ntfrs is registered with the End-Point-Mapper on target server!)" :
<SndCsMain: 1348: 883: S0: 13:22:11> ++ ERROR -
EXCEPTION (000006d9) : WStatus: EPT_S_NOT_REGISTERED
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
Ntfrs is registered with the End-Point-Mapper on target server!)" :
<SndCsMain: 1348: 884: S0: 13:22:11> :SR: Cmd 01212530,
CxtG d89c3554, WS EPT_S_NOT_REGISTERED, To NEW_SRV4.mydomain.com Len:
(368) [SndFail - rpc exception]
ERROR on NtFrs_0005.log : "EPT_S_NOT_REGISTERED(This may indicate that DNS
returns the IP address of the wrong computer. Check DNS records being
returned, Check if FRS is currently running on the target server. Check if
Ntfrs is registered with the End-Point-Mapper on target server!)" :
<SndCsMain: 1348: 904: S0: 13:22:11> :SR: Cmd 01212530,
CxtG d89c3554, WS EPT_S_NOT_REGISTERED, To NEW_SRV4.mydomain.com Len:
(368) [SndFail - Send Penalty]
ERROR on NtFrs_0003.log : "RPC_S_CALL_FAILED_DNE(Indicates RPC Session was
established to target, but there was a failure to send RPC call package.
Check for Networking problems!)" : <FrsDsGetName: 3664:
4580: S0: 17:12:28> :DS: ERROR - DsCrackNames(cn=NEW_srv4,ou=domain
controllers,dc=mydomain,dc=com, 00000002); WStatus: RPC_S_CALL_FAILED_DNE

Found 14 ERROR_ACCESS_DENIED error(s)! Latest ones (up to 3) listed above
Found 3 EPT_S_NOT_REGISTERED error(s)! Latest ones (up to 3) listed above
Found 1 RPC_S_CALL_FAILED_DNE error(s)! Latest ones (up to 3) listed above

......... failed with 18 error entries
Checking NtFrs Service (and dependent services) state...passed
Checking NtFrs related Registry Keys for possible problems...passed
Checking Repadmin Showreps for errors...passed


Final Result = failed with 20 error(s)


*************************

Older Win 2003 non-R2 DC NEW_srv4

------------------------------------------------------------

Checking for errors/warnings in FRS Event Log ....
NtFrs 9.8.2006 2:05:41 Error 13570 The File Replication Service has detected
that the volume hosting the path C: is low on disk space. Files may not
replicate until disk space is made available on this volume. The
available space on the volume can be found by typing "dir /a C:". For
more information about managing space on a volume type "copy /?", "rename
/?", "del /?", "rmdir /?", and "dir /?".
NtFrs 9.8.2006 2:05:41 Error 13570 The File Replication Service has detected
that the volume hosting the path c: is low on disk space. Files may not
replicate until disk space is made available on this volume. The
available space on the volume can be found by typing "dir /a c:". For
more information about managing space on a volume type "copy /?", "rename
/?", "del /?", "rmdir /?", and "dir /?".
......... failed 2
Checking for errors in Directory Service Event Log .... passed
Checking for minimum FRS version requirement ... passed
Checking for errors/warnings in ntfrsutl ds ... passed
Checking for Replica Set configuration triggers... passed
Checking for suspicious file Backlog size... passed
Checking Overall Disk Space and SYSVOL structure (note: integrity is not
checked)... passed
Checking for suspicious inlog entries ... passed
Checking for suspicious outlog entries ...
WARNING: 38,46% (20 out of 52) of your outlog contains Security ACL events
......... passed (with 1 warning(s))
Checking for appropriate staging area size ... passed
Checking for errors in debug logs ...
ERROR on NtFrs_0004.log : "ERROR_SHARING_VIOLATION(For more information see
KB.822300, KB.815473, and KB.823230)" :
<FrsBuildVolSerialNumberToDriveTable:2616: 1481: S1: 12:41:03> WARN -
GetvolumeInformation for C:\; ERROR_SHARING_VIOLATION
ERROR on NtFrs_0004.log : "ERROR_SHARING_VIOLATION(For more information see
KB.822300, KB.815473, and KB.823230)" :
<FrsBuildVolSerialNumberToDriveTable:2616: 1481: S1: 12:46:03> WARN -
GetvolumeInformation for c:\; ERROR_SHARING_VIOLATION
ERROR on NtFrs_0004.log : "ERROR_SHARING_VIOLATION(For more information see
KB.822300, KB.815473, and KB.823230)" :
<FrsBuildVolSerialNumberToDriveTable:2616: 1481: S1: 12:46:05> WARN -
GetvolumeInformation for C:\; ERROR_SHARING_VIOLATION
ERROR on NtFrs_0003.log : "ERROR_ACCESS_DENIED" : <SndCsMain:
2604: 904: S0: 06:39:56> :SR: Cmd 01152508, CxtG d89c3554, WS
ERROR_ACCESS_DENIED, To NEW_srv5.mydomain.com Len: (368) [SndFail - Send
Penalty]
ERROR on NtFrs_0003.log : "ERROR_ACCESS_DENIED" : <SndCsMain:
2604: 877: S0: 06:40:29> :SR: Cmd 01174bd0, CxtG 6ae59d95, WS
ERROR_ACCESS_DENIED, To NEW_srv5.mydomain.com Len: (368) [SndFail - rpc
call]
ERROR on NtFrs_0003.log : "ERROR_ACCESS_DENIED" : <SndCsMain:
2604: 904: S0: 06:40:29> :SR: Cmd 01174bd0, CxtG 6ae59d95, WS
ERROR_ACCESS_DENIED, To NEW_srv5.mydomain.com Len: (368) [SndFail - Send
Penalty]

Found 152 ERROR_SHARING_VIOLATION error(s)! Latest ones (up to 3) listed
above
Found 11 ERROR_ACCESS_DENIED error(s)! Latest ones (up to 3) listed above

......... failed with 163 error entries
Checking NtFrs Service (and dependent services) state...passed
Checking NtFrs related Registry Keys for possible problems...passed
Checking Repadmin Showreps for errors...passed


Final Result = failed with 165 error(s)

*****

dcdiag /test:netlogons passes all tests nicely.

I wouldn't easily like to rebuild whole sysvol because it looks quite risky,
but what other things should I try?
According to my understanding there seems to be problems with RPC, and
somewhy the newest R2 server tries to connect OLD_srv2 and doesn't succeed
whether that machine is online or not. The non-R2 DC NEW_srv4 holds all
operation masters roles, including RPC, and had hold those for a long time.

I also checked this thread
http://www.mail-archive.com/activedir@xxxxxxxxxxxxxxxxxx/msg30321.html but I
have only two new servers listed in NTFRS section.



"Paul Bergson" wrote:

Download and run Ultrasound to check your FRS

http://www.microsoft.com/downloads/details.aspx?familyid=61acb9b9-c354-4f98-a823-24cc0da73b50&displaylang=en

As well as FRSDiag
http://www.microsoft.com/downloads/details.aspx?FamilyId=43CB658E-8553-4DE7-811A-562563EB5EBF&displaylang=en

You could run a test as well, you have to be a domain admin though which I
assume you are.
dcdiag /test:netlogons

If the permissions are out of whack you could consider doing a rebuild of
the sysvol across your domain
http://support.microsoft.com/default.aspx?scid=kb;en-us;315457


--
Paul Bergson MCT, MCSE, MCSA, Security+, CNE, CNA, CCA
http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup

This posting is provided "AS IS" with no warranties, and confers no rights.

"Ilkka Heiskanen" <IlkkaHeiskanen@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:8CBD9DB2-D31B-4D85-8B34-4F142CC23087@xxxxxxxxxxxxxxxx
Hi,

I have a problem that prevents me to change any group policy objects with
group policy management snap-in. When I open a GPO and try to save it, I
get
a message displayed "The Group Policy snapin was unable to save your
changes
due to the
following error: The process cannot access the file because it is being
used
by another process." and the policy does not get saved. No events are
logged
to event logs regarding to this situation.

After reading a lot of discussion in the web about this case, like
http://groups.google.com/group/microsoft.public.windows.server.sbs/browse_thread/thread/b3e28e1c904a0868/a5b7ccf28c2ada36?lnk=st&q=&rnum=8&hl=fi#a5b7ccf28c2ada36
(and many more, too) I have even tried to disable all antivirus software
(F-Secure 5.52) with no help.

The problem was found after I promoted a Win 2003 R2 srv to DC (another
2003
non R2 DC exists, too) and demoted properly an old Win 2000 DC to member
server. All tests that dcdiag and repadmin can run pass. Functionality
level
of domain is 2000 native and forest 2000.

I have also run Process Expoler and FileMon on both new DCs (and the old
demoted one is switched off) but they do not find any other program than
ntfrs.exe using the sysvol folder at all - and stopping ntfrs (net stop
ntfrs) on both servers do not help either. Windows Firewall service is not
running on any of the DCs and there are no other firewalls running. Also
creating a new GPO and trying to modify it doesn't work any better.



.