1

Default Domain Policy is configured to allow System Restore. Registry settings in the policy are also set to update computer registry hex value for restore to 00000000. This applies about 50% of the time. The other 50% of the time, it ignores this and sets the hex value to 00000001, which disables the users ability to create a restore point.

There is not another policy for the OU, it should apply the default domain policy.

settings

gpo

  • How about telling us or showing us the specific GPO settings and Registry value? – joeqwerty Apr 27 '17 at 19:19
  • @joeqwerty sure, added images – G.B. Apr 27 '17 at 19:28
  • Have you done a gpresult on the client? Does it show the policy applying, does it report any errors? – Zoredache Apr 27 '17 at 19:59
  • @Zoredache I couldn't add more than 2 images due to low rep but after running gpresults and generating the html, the only difference was in the section titled "Applied GPOs." The "Revision" heading has "AD (154), Sysvol (154)" when successful and "AD (154) Sysvol(0)" when failed. – G.B. Apr 27 '17 at 20:41
1

I'm guessing you have more than 1 Domain Controller and it seems like you have a replication problem between them, computers that work are probably getting the GPO from the DC where it was created and the ones that don't from the other one.

Those revision numbers suggest AD is replicating but not Sysvol, you can confirm this by checking the version number in the GPT.ini inside Sysvol on each one of the DCs for that GPO:

\\<SERVERNAME>\Sysvol\<DOMAINNAME>\Policies\<GPOID>\gpt.ini

If this is the case then you need to troubleshoot replication, you can try forcing it but how to do that depends on if you are using NTFSR (2003) or DFS (2008+) for Sysvol replication...

0

For AD replication issues, another resource is this TechNet page which has a long list of techniques to consider.

For other people with the same question, where it is NOT a replication error:

Use Powershell's Get-GPResultantSetOfPolicy against the machine and save the results as HTML. The result is very similar to the GPO Editor in layout. But the key feature is that for every setting, it tells you all of the policies that apply, and which one won. Also, be sure to specify the user if you're evaluating user policy. Not sure if you can do so remotely.

  • very useful, thanks for the list of techniques. I'm getting a lot of those errors in the DFS Replication logs. – G.B. May 2 '17 at 19:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.