5

Any ideas why the group policy diagnostic utility GPOTool would report a GPO version mismatch between two domain controllers if the version numbers are a match?

Policy {GUID} 
Error: Version mismatch on dc1.domain.org, DS=65580, sysvol=65576
Friendly name: Default Domain Controllers Policy
Error: Version mismatch on dc2.domain.org, DS=65580, sysvol=65576
Details: 
------------------------------------------------------------
DC: dc1.domain.org
Friendly name: Default Domain Controllers Policy
Created: 7/7/2005 6:39:33 PM
Changed: 6/18/2012 12:33:04 PM
DS version:     1(user) 44(machine)
Sysvol version: 1(user) 40(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: not found
Machine extensions: [{GUID}]
Functionality version: 2
------------------------------------------------------------
DC: dc2.domain.org
Friendly name: Default Domain Controllers Policy
Created: 7/7/2005 6:39:33 PM
Changed: 6/18/2012 12:33:05 PM
DS version:     1(user) 44(machine)
Sysvol version: 1(user) 40(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: not found
Machine extensions: [{GUID}]
Functionality version: 2
2
  • Could this be just because the "changed" timestamp on the 2nd domain controller is 1 second behind, or is that normal because of the lag time inherent in replication? (I would think the latter.)
    – Sam Erde
    Jul 2, 2012 at 13:54
  • I tried backing up the GPO on DC1 and restoring it on DC2, but GPOTool is still reporting a version mismatch between the two objects. Time for more research.
    – Sam Erde
    Jul 2, 2012 at 15:50

3 Answers 3

4

Your issue is caused by a version mismatch between the Default Domain Controllers Policy DS and Sysvol portions, not a difference between the two DC's. Your DC's are in sync with each other, but the data they are syncing is out of sync with itself. What you want to do is set the DS and Sysvol versions to the the same value. To be safe, go with 1(user) 45(machine). The value you will need to enter is 65581 (1 * 65536 + 45 = 65581). Open \\domainname\sysvol\policies\{Default_Domain_Controllers_Policy_GUID}\gpt.ini in notepad and set Version=65581. Now using ADSIEdit, ADExplorer, adfind, etc, browse to CN={Default_Domain_Controllers_Policy_GUID},CN=Policies,CN=System,DC=domainname and set versionnumber to 65581. Now go to lunch and whenyou come back, run GPOTool again. All the version numbers should report as 65581 and/or 1(user) 45(machine).

Note: The Default Domain Controllers Policy GUID is always 6AC1786C-016F-11D2-945F-00C04FB984F9, but verify that is in fact the GUID in case someone renamed it and created another GPO with the same name.

See the following pages for more in depth descriptions of how GPO version numbers are calculated and utilized:

1
  • Sounds like a SOLID insight. I'm looking forward to trying this!
    – Sam Erde
    Jan 10, 2013 at 15:37
1

It's not saying your DCs are version mismatched, it's saying that one of your GPOs is.

You need to track down the offending policy ("Policy {GUID}") and under the sysvol folder on your DCs, navigate to its folder (\DC\sysvol\policies{GUID}) and check the GPT.INI file on both the DCs. It will have a version number in it, and the version number will be different on the different DCs - this is the version mismatch it's complaining about.

Correcting it depends on what exactly caused the mismatch - you may be able to correct it by editing the version number in GPT.ini, or it may be a result of some bigger problem, like faulty FRS replica sets, ACL settings on that particular GPO, etc. Not enough information to determine what exactly the root cause is.

3
  • I get that it's talking about a GPO version mismatch and not the DC's. :) As I said in my question, these GPO's do actually have the same version number. GPOTool, GPMC, and the gpt.ini file all report the same version number. That's why I'm wondering why the GPOTool thinks there is a mismatch.
    – Sam Erde
    Jul 2, 2012 at 13:51
  • As you can see above, everything is exactly identical except for the name of the domain controller and the changed date: it is 1 second behind on the 2nd domain controller.
    – Sam Erde
    Jul 2, 2012 at 13:53
  • @SturdyErde: a 1 second time difference is insufficient to cause time-sych related issues with GPOs or Windows DCs... so that's not what's causing it. Not that I have the slightest idea what would be causing it. I'd say it's time to bust out the detailed CLI tools t diagnose what's going on with your domain. :/ Jul 3, 2012 at 13:48
0

I would look to see if your AD environment is in a Journal wrap state. We ran into this same issue and had to do a D2 restore to get all GPO's back to consistent state.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .