While performing gpresult /r from command line I have noticed that the computer domain labs read policies from 2 domain controllers .

The computer configuration is being read from the DC1 which is a replica for the DC2 and the user configuration is being read from DC2 knowing that DC1 is placed on site A and DC2 is placed on site B .

enter image description here enter image description here

It's weird cause it doesn't happen to other departments or other labs and I'm not sure what is causing it any help would be appreciated altho when i echo the logon server it returns with DC1 .

  • It looks like you applied policies a day apart. Which site is the lab network defined in? – Jim B Dec 12 '16 at 13:44
  • Not necessarily I always creat and modify GPO's and it's located on site A – Elie Dec 12 '16 at 13:47

It sounds like you haven't configured your Active Directory Sites and Services to define your subnets, and indicate which subnets are in which site.

You'll need to do this, so that clients know to contact their closest DC.

enter image description here

  • Yup, that's where I was going. – Jim B Dec 13 '16 at 2:22

It seemed that there was a replication issue between DC1 and DC2 caused by the time the GPO were created like Jim B said it was resolved by doing a gpupdate /force and a restart . Maybe the DC needs more time to replicate from site A to site B cause we don't have site and services configured as Mark Henderson suggested .


Microsoft introduced a new setting in Windows 8/2012 to influence this behavior.

Computer > Policies > Administrative Templates > System > Group Policy:

"Enable AD/DFS domain controller synchronization during policy refresh"

"Enabling this setting will cause the Group Policy Client to connect to the same domain controller for DFS shares as is being used for Active Directory."

Also, the LOGONSERVER environment variable shows the domain controller that authenticated the user account. The computer may have authenticated against a different domain controller. You can use nltest /sc_query:domainfqdn to show the domain controller used to authenticate the computer account.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.