It seems that none of the GPOs for the Computer OU are being applied in our domain. When I run gpresult, the User GPOs are applied without problems, but with the computer GPOs, it says "could not obtain the name of a domain controller."

This is strange because non-local user GPOs are being applied and work without problem.

Our Server is 2008 R2, and we have 2 labs of Win7 desktops.

I gathered some logs from event viewer from what should be a sufficient sample of desktops. Almost all of the errors on the machines are GP errors. The following repeat frequently and comprise the bulk of all errors (source is Group Policy unless otherwise noted):

  • 1054: Could not obtain name of a domain controller
  • 7006: Periodic policy processing failed
  • 7017: LDAP call to connect and bind failed after xxx ms
  • 7320: Failed to register for connectivity
  • 7326: Group Policy failed to discover DC in xxx ms
  • 5719: Computer not able to set up a secure session w/ DC (source: NETLOGON)

Finally, regarding 1054, I checked the preferred DNS for the desktops and they are pointed to our server. There are no DNS errors on the server or any of the desktops.

Any ideas on how to fix this or troubleshoot this further?

  • Note: I just did a fresh install of Win7 on Virtual Box and for the fun of it, joined the domain. I then ran gpresult and both computer and user GPOs are applied. This makes me suspect There is a problem with our desktops, not the server. I suspect re-installing windows on the desktops would solve the problem, but I'd rather solve this directly. Any ideas? – labyrinth Oct 28 '11 at 5:48

I've seen something like this happen once before. In the end it ended up being that the NetBIOS TCP/IP Helper Service had been disabled for some reason on the lab image. This was hard to troubleshoot since:

  • nslookup found the domain just fine
  • I could ping the domain name just fine
  • I could connect to the GPO SYSVOL if I used an IP address
  • I could NOT connect to the GPO SYSVOL via domain UNC, but could directly from the DC's url

It's the helper service that turns "ad.example.com" into something Windows can resolve. In our case we still had a WINS server which managed to mask some of the other side effects of the service being disabled, but WINS can't handle dotted names.

  • Ok, checked TCP/IP Helper, but it's automatic and started. I've tried ping; I'll try some of the others you mention. – labyrinth Oct 24 '11 at 1:47
  • Just like in your situation, nslookup, ping, and connecting to SYSVOL with IP work. In fact, unlike you sysadmin1138, I CAN connect to the GPO via domain UNC as well as the URL. I'm going to try a few more tools next. Does anyone have any more suggestions on how to troubleshoot or resolve this? It's kind of important to be able to apply GPOs for Computers... – labyrinth Oct 28 '11 at 0:11

In a fresh, virtual installation (on VirtualBox), I saw there were no errors when I ran gpupdate. This indicated there was not a problem with the server, AD, or anything else regarding the GPO system, but rather with local machines. Another sysadmin tried leaving, then re-joining the domain. We did that on all machines that were unable to receive computer GPOs, and now everything works.

I'm new to virtualization and never thought of it as a troubleshooting tool, but I definitely will from now on.

  • 1
    P.S., anybody know how to find out when rejoining the domain is the best solution? I was focused on DNS and Group Policy errors, but maybe there's a more pertinent error to be looking for? – labyrinth Oct 31 '11 at 2:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.