2

We have a problem where domain members built from a certain Windows 8 image can no longer update Computer Group Policy.

These domain member have recently been moved to a new Organisational Unit, but moving them back is not possible because the OU structure has changed significantly.

There were also some (undocumented) Group Policy changes, but this should be irrelevant given that the error still happens when the domain member is in an OU with no GPOs applied to it.

Other domain members (not built from said Windows 8 image) are fine. Also, the problem doesn't happen when joining the Windows 8 image to a new forest. It's only the combination of the old forest and the specific Windows 8 image.

In the gpresult /h output, we see that Group Policy Infrastructure component has failed due to the error "A directory service error has occurred."

We believe that there is something on the client side that needs to be deleted/reset so that the client can behave normally.

Does anyone know how to fix this?

2
  • 1
    Remove and rejoin to domain, possibly? I'm pretty sure you're on the wrong track at present, group policy isn't something you can just 'reset' on client side as you wish to. Registry changes from your previous undocumented GPOs will persist. – BlueCompute Aug 26 '14 at 8:28
  • @BlueCompute: we had already tried re-joining to the domain, to no avail. The problem is that we have a 1,000 machines based on this Windows 8 image out in the field, so fixing it without having to recall/re-image all these machines would be really good. I understand that registry tattoos will persist, but the GPOs themselves should be removable, right? – badsector Aug 26 '14 at 8:47
1

You can remove the current GPO settings by removing the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy key and then repopulating with gpupdate /force

I am not sure this will solve your issue, but I have found it useful to force policy updates when they seem to be otherwise stuck. I would try to mass push it via psexec.

2
  • Unfortunately we've already tried this. No luck. – badsector Aug 29 '14 at 3:38
  • Is there anything in the event logs of the client or server? – Philosophene Aug 29 '14 at 18:27
1

Although this is an old question, this might be helpful to others. Things to try if your GPclient is refusing to pull new GPOs (assuming you have checked beforehand, that link-state and scope, etc. of the new GPOs is correct):

  1. gpupdate /target:computer /force /boot
  2. Rejoin the client to the domain
  3. Delete GPO Cache "%ALLUSERSPROFILE%\Application Data\Microsoft\Group Policy\History\*.*
  4. Delete HKLM\SOFTWARE\Policies
  5. Delete HKLM\SOFTWARE\Policies\Microsoft\Windows\System!UserPolicyMode (defines loopback mode)
  6. Delete C:\WINDOWS\security\Database\secedit.sdb
  7. Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
  8. Delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy
  9. Delete HKLM\SOFTWARE\Microsoft\Group Policy
  10. Use cleanregpol.exe (have a google for it)

I usally had the most success by using step 4. followed by 1. Usual word of caution applies for editing the registry.

0

Indeed. It's a stuck policy. Fortunately, there is a rather ingenious way to fix this problem. Unfortunately, it's not common knowledge. Hopefully this answer will get around to enough sysadmins to fix that.

By the way, this works on all versions of Windows.

This solution is dependent upon the machine-in-question being dis-joined from the domain. If it is NOT dis-joined from the domain via the OS, then this will NOT work.

After the machine is dis-joined from the DC (Domain Controller), login using the local (machine) administrator account.

Go to Start (open the Start menu) > Run (open the Run app), and type 'cmd' (without the quotes) and press Enter. [Or open the Start menu and then run the Command Prompt program.]

Type gpupdate /force /boot and press Enter.

Once it's complete, reboot. The old group policy is gone.

Basically, how this works is it (since it gets no policy when you run the command), it applies an empty policy, which effectively removes the stuck policy once and for all.

If you run into problems, run gpresult /H GPReport.html from a Command Prompt window. If you see the DC or evidence that it pulled a policy, separate your computer from the network that's running on the DC and plug the machine into a separate network.

No internet connection is required for this solution, but the link needs to be up, and it needs to have an IP address.

6

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.