0

Is it possible for a group policy to revert back to its original state upon server restart? Our servers are hosted as a Virtual Machine on the rack. We had to restart our server for some reason and all of a sudden we cannot remote desktop into the server any more. Pinging the server succeeds but RDPing into it fails. My assumption is that the group policy has reverted back preventing any remote desktop connections from taking place. Is that a possibility? Since the network is managed by another group, we don't have the authority to physically look into what's going on with this particular VM.

Can somebody suggest some ideas?

Thanks

4 Answers 4

2

This very likely is not a group policy thing. It wouldn't reset itself when you restart the computer. It would grab the latest copy from a DC, but it's been doing that at least once every 90 minutes anyways.

What you probably have is a hung service preventing the server from starting up completely. This would prevent you from RDPing in. You can usually hit the server from another machine with remote computer manager. This will let you look at the event logs, check out the services, and figure out what's going wrong. You should also be able to kill processes with psexec. All else fails, issue a shutdown command across the network: "shutdown /m \machinename /t 0 /r"

If you still think it's RDP being denied, you can run regedit and attach the server's registry from a remote machine. Then drill down to HKLM\System\CurrentControlSet\Control\TerminalServer and set fDenyTSConnections to 0.

3
  • Thanks. Is this a known issue with Windows 2003(hung services during startup)?
    – sc_ray
    Mar 1, 2011 at 16:18
  • @sc - I don't know about "known issue" but I've run into it more than a few times.
    – Jason Berg
    Mar 1, 2011 at 18:28
  • In my experience rebooting a Win 2003 server via RDP due to Windows Updates (clicking yes in the popup to restart, not manually restarting) will 9/10 times result in the same senerio you describe. Gaining console access (through VM Manager if needed) may help, or force rebooting it again works. Mar 5, 2011 at 13:33
1

Windows 2003 seems prone to not actually restart but hang during restart with most services (like RDP) shutdown but still responding to basic ping - giving this illusion.

Forcing a real restart usually helps in this case, and it's often possible to do using the shutdown command from another machine - targeting the problematic host remotely (try shutdown -i).

0

It's more likely to be a change to an existing policy or a newly added policy preventing you from RDPing. Are you able to look at the Group Policy objects that the server is having applied to it?

2
  • Thanks. Is there a way to check the Group policy objects remotely?
    – sc_ray
    Feb 25, 2011 at 16:24
  • If you have a server in the same domain, install the Group Policy Management Console, and you should be able to browse to the OU that your unreachable server is in, and look at the policies. Feb 25, 2011 at 16:45
0

Sounds like someone moved your VM to a different OU with different GPOs applied to it or just changed the GPOs on it's current container.

If you have windows XP I would just grab the Microsoft Server Administration Resource pack. You can use Group Policy Management to look at the OU and the GPOs being applied.

If you have Windows 7 just install the administration pack through Windows Components.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .