Group Policy failing for one SQL server

Question

One specific member server - call it SQLProd - is experiencing failures pulling down the computer account GPOs. All authentication, etc is functioning perfectly. Domain controllers and server are both is 2008 R2.

I am receiving event ID 1030 from the GroupPolicy with an error code of 8341 with a DCname of pdc.mydomain.org. I was also receiving LDAP bind errors 1006 with an error code of 82 "Local Error".

I ran dcdiag and repadmin to verify the health of my domain. All showed well other than the RODC settings. My DNS is in perfect working order and the network settings on the SQL box look good.

Windows IP Configuration

Host Name . . . . . . . . . . . . : SQLProd
Primary Dns Suffix  . . . . . . . : mydomain.org
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : mydomain.org

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix  . :
Description . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
Physical Address. . . . . . . . . : 00-0C-29-ED-CC-3B
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.100.20(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.100.1
DNS Servers . . . . . . . . . . . : 192.168.100.80
                                    192.168.100.81
NetBIOS over Tcpip. . . . . . . . : Enabled

About the time these errors started occurring (within about 48 hours prior) the DNS entry on this box had disappeared. I recreated it with an ipconfig /registerdns. Within 48 hours of that time I demoted our last 2003 domain controller. At about this time the NTP on SQLProd cut over from the 2003 (formerly the PDC emulator) to the new PDC emulator.

Where should I be looking to debug this problem? I assume one of the debug logs would provide some insight but I'm not sure which to enable or where to look.

EDIT: The issue started about 23 days after the pwdLastSetAttribute and we have the default 30 day machine lifetime in place. The lastLogonTimestamp whenChanged attributes have very similar values and are set within a day of when we started having problems.

GPresult and the RSOP snapin do not provide any additional info. Both provide absolutely no output for the computer section.

EDIT: Stranger and stranger.. The error just disappeared on its own with no intervention on my part after occurring regularly for the last 9 days. Hopefully it stays that way.

EDIT: Things were fine for about four hours but now have returned to their previous behavior. Any suggestions would be much appreciated. I also tried nltest /dsgetdc: which indicates there are no communication problems.

EDIT: On some additional searching I came across this site which indicated similar problems. I just restarted the KDC services on both DCs and the issue appears gone for the moment.

Answer 1

I have had no further problems since restarting the key distribution services. My virtual DC had been rebooted several times since the problem occurred but the physical box had not.

Answer 2

ON SQLProd, go to the command line and run "gpresult /r". This will output the RSOP for all group policies being applied to the computer along with any that are failing. Check to see if the computer policies are attempting to be applied and if they are failing or succeeding. Also check to see if the listings for domain, domain type and computer supplying the group policy match what should exist. This will allow you to narrow down the problem to the computer or to the scope of the GP, etc.