1

I recently moved a Windows Server 2008 R2 machine from one domain to another. Everything appears fine on the surface. It attached to the new domain and I can remote to and log into it using an account on the new domain. There are forward and reverse lookup entries in DNS for this machine and nslookup resolves it correctly for both hostname and IP address. I can also ping the machine from other machines in the domain, such as the DC, and I can ping the DC from the machine.

However, when I try to run "gpupdate /force" on this machine to update it with the new group policy it fails with the message:

The processing of Group Policy failed. Windows could not determine if the user and computer accounts are in the same forest. Ensure the user domain name matches the name of a trusted domain that resides in the same forest as teh computer account.

It also throws event ID 1110 with the error code 1311 in the event log. My research turned up tow main solutions. 1. ensure netlogon service is running, it is and I've restarted it several times without issue but it doesn't resolve the error. 2. disjoin and rejoin the domain, which I have also done several times to no avail.

I'm at a loss for what to do next since there doesn't seem to be any issues besides this group policy one on this machine. I've also moved several other machines to the new domain and none of those have issues. I've also disabled the firewall and antivirus to rule out port or protocol blocking.

Improve this question
3
  • It also appears like we are unable to add a new domain user as a user to app pools under IIS as well so there are other issues with this server communicating with the domain that I cannot track down. I was able to attach it and log in as a domain user without issue as well as ping the DC.
    – Tony
    Sep 14, 2015 at 14:04
  • One more detail to add to my issues. When trying to grant permissions to a new domain user to a certificate it cannot find it. However, I was able to resolve domain users inside "local users and groups" to make a domain account a local administrator. When I have issues communicating with the DC seems to be very sporadic.
    – Tony
    Sep 14, 2015 at 14:44
  • Couple of bits of advise from when I've been in similar situations although when getting to these depths it can be hard to really pinpoint the issue. Firstly in light of the new IIS application pool issue, what account are the IIS Services and the application pools running under, check they are not referencing an account on the old Domain which would now be orphaned... Secondly on the GPUpdate it sounds like a stuck policy, try running GPUpdate /Force /Boot if that fails might have to dive in to the registry and the GPO folder to try a forceful clean up...
    – CharlesH
    Sep 14, 2015 at 15:44

1 Answer 1

Reset to default
1

Thanks to anyone who assisted, we decided it was quicker and simpler to rebuild this particular server than to continue to troubleshoot it though.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.