3

We are facing an issue on one of our domains where machines are not all running group policy refreshes at its default interval. I am not seeing the 1501 events logged in the system log, I occasionally see a 1503 on these machines.

We have a scheduled task that triggers when 1501 is written to the event log and on a large number this works fine. I have a bunch (350+ currently) that are not working as expected. They are in a bunch of our different offices across different countries, yet they all have the same problem.

If I run a manual gpupdate on these machines, it refreshes group policy and it also logs the 1501 event into the system event log which in turn triggers our scheduled task to fire.

There are no errors in the Group Policy event log, GP fires when you boot up & when a user logs in. It doesn't matter what user is currently logged in, GP doesnt refresh. We are using the default interval (60min +- 30min).

I have turned on the GPSvcDebugLogging and reviewed its log, I cant find anything in there. Data is written to that ~within the normal GP refresh interval and there are no errors or warnings that I can find. However we still dont get the event 1501 entry into the system event log, according to Microsoft, the informational entry is: The Group Policy settings for the user were processed successfully. There were no changes detected since the last successful processing of Group Policy.

All of our clients are Windows 7 Enterprise, with the latest updates released running 1 month behind. Users all have a variety of software installed, unlikely that 2 machines are identical but I doubt that its an external piece of software causing the issue, I would expect its likely to be something internal to windows. We are running a 2008 R2 domain, domain controllers in each office, ~50 GPO's but varies as some are dependent on group membership however there are no errors when reviewing a result report.

I need to find other things to investigate to fix this issue, has anyone come across this before, has a fix or can suggest some things I can look into, so I can look at solving this.

Thanks

  • I would start with the basics: Run the DC and DNS Best Practice Analyzers on your DC's. Run DCDIAG, Check and verify that DNS is configured correctly on your DC's and all of your client machines, make sure that Active Directory Sites and Services is configured correctly. Check the Event Logs on your DC's and your clients, etc. – joeqwerty Apr 16 '16 at 3:31
  • Hi Joe - Logs look fine on the clients & DC's. We have users in the same site and different sites that are both affected and unaffected which is the weird part. We have ~5000 users, of with so far we've identified over 350 with issues but we've only looked at a subset of machines. Sites and services are setup correctly as well. DCDiag didnt report any issues either. – LordBoBCUP Apr 16 '16 at 4:16
  • Try running RSOP on some of the problem machines and look for ANY settings within the GP admin template section. Someone may have unexpectedly changed the interval, or disabled background refresh. Computer Configuration\Administrative Templates\System\Group Policy\Turn off background refresh of Group Policy – Clayton Apr 18 '16 at 13:55
  • Another idea... if someone was really anti-policy they may have disabled it without using policy. Check for manual mods to the following registry key: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableBkGndGroupPolicy – Clayton Apr 18 '16 at 14:33
  • Hi Craig, Checked RSOP a couple of times now, nothing regarding background refresh at all, either changing the time or disabling it. Also checked the registry and the key hasn't been set manually either. (plus users don't have local admin rights so cant set it in HKLM). – LordBoBCUP Apr 19 '16 at 22:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.