I've created two test VMs in VMWare, both Server 2012 R2 Standard. One was promoted to a DC, with the domain name being test2.local. I modified the DNS record on the other server, and joined it to the test domain. Then I did (from an administrative command prompt) gpupdate /force and the gpresult /H gpresult.html. I looked in the gpresult.html file and saw a warning on the Default Domain Policy. It says: A fast link was detected (not worrying about now) and "AD / SYSVOL Version Mismatch" on Default Domain Policy. Opening up the Default Domain Policy under Applied GPOs shows that the SYSVOL number is 65535.

From what I have been able to gather, this mismatch occurs when there is security filtering and/or WMI filtering in place. I don't think I'm using either one of those, unless they are applied by default.

At this point, I just want a clean base that applies the unchanged Default Domain Policy to a machine without any errors. Then I can keep testing the GPO I'm building without wondering where the errors/warnings are coming from.

  • What does GPMC show for the user and computer versions (n/n)? – Greg Askew Dec 16 '15 at 19:13
  • 65535 is always a sign that there was a failure to read the GPO. This could be caused by security filtering or WMI filtering, or read gpLink/gpOptions permissions missing, or replication delays, etc. – Ryan Ries Dec 16 '15 at 19:24
  • @GregAskew User version: 0/0 Computer version: 1/1 – Carrot Dec 16 '15 at 19:48
  • @RyanRies That's what I was reading, but I can't seem to find a way to fix it. I didn't do anything other than join the computer to the domain. Is there something special I need to do in order to allow the machine to read the GPO? – Carrot Dec 16 '15 at 19:52
  • Does gpresult /h report the expected information when run on the domain controller? – Greg Askew Dec 16 '15 at 20:01

If you're ok with reverting to the default, you can try running the following on the domain controller:

dcgpofix /ignoreschema /target:Domain  


  • Still nothing... I'm seeing the version numbers increment in GPMC, but when I run gpresult on the domain controller, it still shows the SYSVOL version as 65535. – Carrot Dec 16 '15 at 23:49
  • Try enabling group policy environment debug logging to see if that reveals anything: social.technet.microsoft.com/wiki/contents/articles/… – Greg Askew Dec 17 '15 at 18:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.