I have a Windows network based on an ageing Windows Server 2003 infrastructure, with two DCs, configured with replication between each other.

While trying to find out why a certain GPO wasn't being applied, I discovered that the computer group membership isn't being set correctly on the actual computer. Running as administrator: gpresult /v only lists the default groups, and not the other groups the computer is a member of. These groups are shown if I go to "Member of" for the computer account in the domain. The groups are global security groups (and not distribution).

If I apply the GPO setting to the Default Domain Policy, it's applied on the computer as well - so it's able to get its GPO settings and apply them.

Any user group membership is available, even if the user has just been added to the group.

I've tried klist purge, both with and without specificity (-lh, etc), removing the computer from the domain (from the computer itself) and rejoining it to the domain. No change (if anything I lost the membership of the group "domain computers").

I've verified that replication between the DCs work with dcdiag and dcdiag /c, and the gpresult /v call shows the main DC (which is also IM) as the source (I've seen both - no change).

I'm completely lost about how to debug this any further; whoami /groups doesn't show anything except for the builtin groups. There are no warnings or errors in the event log for either DC server.

  • What is the group type? – Greg Askew Dec 10 '15 at 13:48
  • @GregAskew Global, Security, not distribution – fiskfisk Dec 10 '15 at 13:51
  • Universal, Global, DomainLocal? – Greg Askew Dec 10 '15 at 13:53
  • @GregAskew Global, just edited my comment. DC Mode is set to Windows Server 2003. – fiskfisk Dec 10 '15 at 13:54
  • 1
    If you run the Group Policy Modeling Wizard against the computer, does it show the GPO in scope to apply? – Greg Askew Dec 10 '15 at 13:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.