Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Any ideas why the group policy diagnostic utility GPOTool would report a GPO version mismatch between two domain controllers if the version numbers are a match?

Policy {GUID} 
Error: Version mismatch on dc1.domain.org, DS=65580, sysvol=65576
Friendly name: Default Domain Controllers Policy
Error: Version mismatch on dc2.domain.org, DS=65580, sysvol=65576
Details: 
------------------------------------------------------------
DC: dc1.domain.org
Friendly name: Default Domain Controllers Policy
Created: 7/7/2005 6:39:33 PM
Changed: 6/18/2012 12:33:04 PM
DS version:     1(user) 44(machine)
Sysvol version: 1(user) 40(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: not found
Machine extensions: [{GUID}]
Functionality version: 2
------------------------------------------------------------
DC: dc2.domain.org
Friendly name: Default Domain Controllers Policy
Created: 7/7/2005 6:39:33 PM
Changed: 6/18/2012 12:33:05 PM
DS version:     1(user) 44(machine)
Sysvol version: 1(user) 40(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: not found
Machine extensions: [{GUID}]
Functionality version: 2
share|improve this question
    
Could this be just because the "changed" timestamp on the 2nd domain controller is 1 second behind, or is that normal because of the lag time inherent in replication? (I would think the latter.) –  SturdyErde Jul 2 '12 at 13:54
    
I tried backing up the GPO on DC1 and restoring it on DC2, but GPOTool is still reporting a version mismatch between the two objects. Time for more research. –  SturdyErde Jul 2 '12 at 15:50

2 Answers 2

up vote 3 down vote accepted

Your issue is caused by a version mismatch between the Default Domain Controllers Policy DS and Sysvol portions, not a difference between the two DC's. Your DC's are in sync with each other, but the data they are syncing is out of sync with itself. What you want to do is set the DS and Sysvol versions to the the same value. To be safe, go with 1(user) 45(machine). The value you will need to enter is 65581 (1 * 65536 + 45 = 65581). Open \\domainname\sysvol\policies\{Default_Domain_Controllers_Policy_GUID}\gpt.ini in notepad and set Version=65581. Now using ADSIEdit, ADExplorer, adfind, etc, browse to CN={Default_Domain_Controllers_Policy_GUID},CN=Policies,CN=System,DC=domainname and set versionnumber to 65581. Now go to lunch and whenyou come back, run GPOTool again. All the version numbers should report as 65581 and/or 1(user) 45(machine).

Note: The Default Domain Controllers Policy GUID is always 6AC1786C-016F-11D2-945F-00C04FB984F9, but verify that is in fact the GUID in case someone renamed it and created another GPO with the same name.

See the following pages for more in depth descriptions of how GPO version numbers are calculated and utilized:

share|improve this answer
    
Sounds like a SOLID insight. I'm looking forward to trying this! –  SturdyErde Jan 10 '13 at 15:37

It's not saying your DCs are version mismatched, it's saying that one of your GPOs is.

You need to track down the offending policy ("Policy {GUID}") and under the sysvol folder on your DCs, navigate to its folder (\DC\sysvol\policies{GUID}) and check the GPT.INI file on both the DCs. It will have a version number in it, and the version number will be different on the different DCs - this is the version mismatch it's complaining about.

Correcting it depends on what exactly caused the mismatch - you may be able to correct it by editing the version number in GPT.ini, or it may be a result of some bigger problem, like faulty FRS replica sets, ACL settings on that particular GPO, etc. Not enough information to determine what exactly the root cause is.

share|improve this answer
    
I get that it's talking about a GPO version mismatch and not the DC's. :) As I said in my question, these GPO's do actually have the same version number. GPOTool, GPMC, and the gpt.ini file all report the same version number. That's why I'm wondering why the GPOTool thinks there is a mismatch. –  SturdyErde Jul 2 '12 at 13:51
    
As you can see above, everything is exactly identical except for the name of the domain controller and the changed date: it is 1 second behind on the 2nd domain controller. –  SturdyErde Jul 2 '12 at 13:53
    
@SturdyErde: a 1 second time difference is insufficient to cause time-sych related issues with GPOs or Windows DCs... so that's not what's causing it. Not that I have the slightest idea what would be causing it. I'd say it's time to bust out the detailed CLI tools t diagnose what's going on with your domain. :/ –  HopelessN00b Jul 3 '12 at 13:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.