Re: New GPO Not Recognized by Clients

Tech Tip: Click here to run a free scan for Windows Errors and optimize PC performance

Well, of the mismatches I see, they appear to be on the same DCs and specifically related to FRS (SYSVOL), so that is where I would start. It appears that ghsads2 and smsfs have some GPOs that are inconsistent. You might want to make sure that FRS is working on those two boxes. If you do a search on 'FRS troubleshooting' in the MS KB, you will find a slew of articles with specific suggestions on steps you can take to get FRS working again.

Darren

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy

Script Group Policy Settings with the GPExpert Scripting Toolkit for PowerShell!
Find out more at http://www.sdmsoftware.com/products2.php

Visit the GPOGUY: http://www.gpoguy.com -- The Windows Group Policy Information Hub:
FAQs, Training Videos, Whitepapers and Utilities for all things Group
Policy-related

"Scott" <Scott@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message news:BE40A736-1376-4BEF-AAED-7630B18258E9@xxxxxxxxxxxxxxxx
Darren,

Event logs on the three DC's in our central site show nothing useful.
Running replmon--searching DC's for replication failures yielded no failures.
Repadmin /showreps shows replication completely normal. DNS resolution normal
on all DC's.
I'm dealing with an 'inherited network.'
how can I resolve the inconsistencies which show up in gpotool?


"Darren Mar-Elia" wrote:

Thanks for the kind words Scott. The most likely scenario here is that the
SYSVOL portion of the GPO is not replicating to those DCs. That would
indicate an FRS error. Look in the FRS event log on the problem DCs and see
if it shows anything useful. Also, make sure AD is actuall replicating
properly as well. It could be a DNS issue if AD is not replicating.

Darren

--
Darren Mar-Elia
MS-MVP-Windows Server--Group Policy

Script Group Policy Settings with the GPExpert Scripting Toolkit for
PowerShell!
Find out more at http://www.sdmsoftware.com/products2.php

Visit the GPOGUY: http://www.gpoguy.com -- The Windows Group Policy
Information Hub:
FAQs, Training Videos, Whitepapers and Utilities for all things Group
Policy-related

"Scott" <Scott@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:38CEE2D4-0464-4DE4-9992-A6AE0F437C5C@xxxxxxxxxxxxxxxx
> Hi Darren,
>
> Thnx for responding. I've read a number of your papers over the years > and
> am
> an admirer. Your suggestion re the goptool was 'right on.' Here is the
> output
> with respect to the GPO--I'm just not sure what to do about it:
>
> Policy {10198FFA-8805-4705-97AB-01C447A71D7B}
> Friendly name: TIS Staff Policy
> Error: ghsads - ghsads2 sysvol mismatch
> Error: ghsads - smsfs sysvol mismatch
> Details:
> ------------------------------------------------------------
> DC: ghsads
> Friendly name: TIS Staff Policy
> Created: 11/8/2007 3:31:31 PM
> Changed: 11/9/2007 12:40:52 AM
> DS version: 6(user) 0(machine)
> Sysvol version: 6(user) 0(machine)
> Flags: 0 (user side enabled; machine side enabled)
> User extensions:
> [{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}][{A2E30F80-D7DE-11D2-BBDE-00C04F86AE3B}{FC715823-C5FB-11D1-9EEF-00A0C90347FF}]
> Machine extensions: not found
> Functionality version: 2
> ------------------------------------------------------------
> ------------------------------------------------------------
> DC: ghsads2
> Friendly name: TIS Staff Policy
> Created: 11/8/2007 3:31:31 PM
> Changed: 11/9/2007 12:41:02 AM
> DS version: 6(user) 0(machine)
> Sysvol version: 6(user) 0(machine)
> Flags: 0 (user side enabled; machine side enabled)
> User extensions:
> [{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}][{A2E30F80-D7DE-11D2-BBDE-00C04F86AE3B}{FC715823-C5FB-11D1-9EEF-00A0C90347FF}]
> Machine extensions: not found
> Functionality version: 2
> ------------------------------------------------------------
> ------------------------------------------------------------
> DC: smsfs
> Friendly name: TIS Staff Policy
> Created: 11/8/2007 3:31:31 PM
> Changed: 11/9/2007 12:40:59 AM
> DS version: 6(user) 0(machine)
> Sysvol version: 6(user) 0(machine)
> Flags: 0 (user side enabled; machine side enabled)
> User extensions:
> [{42B5FAAE-6536-11D2-AE5A-0000F87571E3}{40B66650-4972-11D1-A7CA-0000F87571E3}][{A2E30F80-D7DE-11D2-BBDE-00C04F86AE3B}{FC715823-C5FB-11D1-9EEF-00A0C90347FF}]
> Machine extensions: not found
> Functionality version: 2
>
>
> "Darren Mar-Elia" wrote:
>
>> Scott-
>> Not sure how many DCs you have in your environment but have you tried
>> running GPOTool from that client to verify that the GPO you created >> has
>> successfully replicated to the DC that the client is using to grab
>> policy?
>> There could be a DC replication issue that is causing that client to >> not
>> yet
>> see the GPO.
>>
>> -- >> Darren Mar-Elia
>> MS-MVP-Windows Server--Group Policy
>>
>> Script Group Policy Settings with the GPExpert Scripting Toolkit for
>> PowerShell!
>> Find out more at http://www.sdmsoftware.com/products2.php
>>
>> Visit the GPOGUY: http://www.gpoguy.com -- The Windows Group Policy
>> Information Hub:
>> FAQs, Training Videos, Whitepapers and Utilities for all things Group
>> Policy-related
>>
>> "Scott" <Scott@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
>> news:6AB2EE29-7E72-4B87-8D7F-1975503F4E6C@xxxxxxxxxxxxxxxx
>> > Hi Florian,
>> >
>> > Thnx for the response. Yes, I performed a gpupdate /force and >> > rebooted
>> > on
>> > clients with no resolution of the issue.
>> >
>> > "Florian Frommherz [MVP]" wrote:
>> >
>> >> Howdie!
>> >>
>> >> Scott schrieb:
>> >> > Recently created a new GPO consisting User Config settings of a
>> >> > logon
>> >> > and
>> >> > logoff script and some URL Favorites definitions under Internet
>> >> > Explorer
>> >> > Maintenance. This GPO has identical permissions as other GPO's in
>> >> > the
>> >> > domain.
>> >> > The GPO is linked to an OU containing the user accounts to which >> >> > the
>> >> > GPO is
>> >> > designed to apply and is enabled. However, a gpresult from any of
>> >> > the
>> >> > computers users are logging into shows that they are not getting
>> >> > this
>> >> > new
>> >> > GPO. The new GPO is not even recognized and filtered out. It just
>> >> > isn't
>> >> > shown
>> >> > at all. Other GPO's are recognized by the clients. I have tried
>> >> > doing a
>> >> > gpupdate /force on the three domain controllers (including PDC
>> >> > Emulator)
>> >> > which authenticate these users and rebooting the DC's. Still no >> >> > joy.
>> >> > Antivirus software (Sophos) has the appropriate sysvol directory
>> >> > exclusions
>> >> > on the DC's.
>> >>
>> >> You tried a gpupdate /force on one of the client computers? Was >> >> that a
>> >> new Group Policy you created or an existing one?
>> >>
>> >> cheers,
>> >>
>> >> Florian
>> >> -- >> >> Microsoft MVP - Windows Server - Group Policy.
>> >> eMail: prename [at] frickelsoft [dot] net.
>> >> blog: http://www.frickelsoft.net/blog.
>> >>
>>



.

Relevant Pages

  • * 1058 and 1030
    ... You talked about a quick fix but didn't mentioned what/how. ... The DC looks for Group Policy information ... FRS, File Replication ... >Services is responsible for maintaining the SYSVOL. ...
    (microsoft.public.windows.server.general)
  • * 1058 and 1030
    ... You talked about a quick fix but didn't mentioned what/how. ... The DC looks for Group Policy information ... FRS, File Replication ... >Services is responsible for maintaining the SYSVOL. ...
    (microsoft.public.windows.server.general)
  • Re: Group policy and File Replication Service
    ... the Windows Group Policy Guide is out from Microsoft Press!!! ... >> when some of the other DC's it's trying to replicate with are offline? ... >>> SYSVOL replication will prevent clients from getting GP correctly. ... your first order of business is to fix FRS replication between all ...
    (microsoft.public.windows.group_policy)
  • * 1058 and 1030
    ... The quick fix, is not something you would normally do ... Did you check to see if FRS is running, ... FRS is how the sysvol is ... If group policy processing isn't absolutely necessary, ...
    (microsoft.public.windows.server.general)
  • Re: Reducing Group Policy size in SysVol folder?
    ... We have a lot of GPOs and our SysVol folder is now over 1 GBs ... the Group Policy Client Side Extensions for Vista would be of any use? ... you have ADMX template files that Vista and Server 2008 use ...
    (microsoft.public.windows.group_policy)