1

I am really lost as to what is the reason as to why my group policy is not working on my domain. I have setup a GPO for my wsus server to a specific OU in my domain. It seems as of right now, none of my machines have inherited that GPO. I have manually put it in quite a few computers.

Most of my computers in the domain are linked up to my wsus server, but all my desired settings are not there.

If I run gpresult /R, On one computer I ran this on, it is linking to my backup domain controller and not my main. On another computer I checked this on, it is linking to my main DC, but it did no inherit the GPO.

When looking on my DC on gpmc - I see the policy is forced to the OU as #1 precedence.

Thank for any help.

Improve this question
1
  • 1
    There are no "backup" or "main" domain controller computers in Active Directory. They're all just domain controllers.
    – Evan Anderson
    May 14, 2010 at 13:11

3 Answers 3

Reset to default
1

How long have you waited, it takes up an hour for GPO to apply, and up to 22 hours for WU to connect to WSUS.

Try running gpupdate /force /boot on a client (warning, it'll reboot). That should force it to pull all the latest GPO settings from the nearest DC.

Which specific settings are you missing?

(Also, GPO presidence is only within the scope you're currently viewing. Other GPOs can still override it. If you have more than one GPO specifying WSUS settings, they could be overriding; if that's the case, list out what type of container their attached to an we can help you arrange the actual order.)

Improve this answer
1

I assume the PC's are in the OU that you have the GPO applied to. If not, that's a problem.

Have you tried running "gpupdate" on a client machine? If you are on a gig network and it sits for a few seconds "refreshing policy" then typically it is grabbing the new policy. If it flashes up and down real fast, then it didn't grab anything. Then you can use "wuauclt -dectectnow" and "wuauclt -reportnow" on a client machine to force it to check for updates and report to the WSUS server.

If gpupdate grabs the new policy then I would check sites and services -> sites -> intersites transport -> properties to see what "replicate every" is set to, and you may want to lower than number. 15 minutes is the default I think.

If gpupdate doesn't grab the new policy I would check sites and services to make sure than the DC's all have the correct NTDS connections.

Also check the default domain policy to make sure that it is not overriding the OU GP. Doubt that's it, but worth a check.

Improve this answer
7
  • I believe the default is 20 minutes on 2003; dcdiag and replmon would help diagnose any DC-to-DC errors.
    – Chris S
    May 14, 2010 at 13:09
  • I have some new news. First off, This has been a problem for a long time. So, I know that all the computers have had the chance to pull this GPO. Secondly, I went gpmc and did a GP Modeling... It said that GPO was denied because of security filtering. So I changed that to allow everyone. When I re-ran this query, it got denied again, but it says reason denied, "Empty"
    – Cory
    May 14, 2010 at 13:12
  • One more thing... should this GPO be targeted to users or computers?
    – Cory
    May 14, 2010 at 13:14
  • WSUS is a Computer setting. How much have you changed the security setting in GPMC? It's a rare occasion that the defaults aren't good enough.
    – Chris S
    May 14, 2010 at 13:20
  • The only thing I ever changed was security filtering. Everything else seems ok.
    – Cory
    May 14, 2010 at 13:27
1

Change the security filtering on the GPO to apply to Domain Computers, not Authenticated Users. Not this
(source: grouppolicy.biz)

Improve this answer

You must log in to answer this question.