0

I have created a GPO and linked to an OU. but somehow the computer settings wont be able to applied.

When I run gpupdate or gpupdate /force, I got 2 messages.

  1. The Group Policy Client Side Extension Folder Redirection was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.

  2. The processing of Group Policy failed. Windows attempted to read the file \domain.com\SysVol\domain.com\Policies{34DB7A96-8089-4EBC-B161-A1D7C0BCB2B0}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

    a) Name Resolution/Network Connectivity to the current domain controller.

    b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).

    c) The Distributed File System (DFS) client has been disabled.

So I tested, I can have access to {34DB7A96-8089-4EBC-B161-A1D7C0BCB2B0} from

\\dc1\sysvol\domain.com\Policies

\\dc2\sysvol\domain.com\Policies

But I can't find the same GPO by accessing share

\\domain.com\sysvol\domain.com\Policies

This issue happened on some Win2008R2 server, but other Win2012R2 servers has no such issue.

The user GPO was applied but Computer GPO wont. The GPO was applied from DC2. All the GPOs were replicated between DCs, DFS is running OK.

Any idea?

  • Any Security Filtering enabled besides Authenticated Users? – TheCleaner Jun 14 '17 at 14:54
  • Any "strange" dcdiag output on one of your DCs (I assume you only have 2 DCs in your domain)? – Lenniey Jun 14 '17 at 15:01
  • 1
    You need to validate which domain controller you are connecting to when accessing: \\domain.com\sysvol\domain.com\Policies. Right-click on one of the folders > Properties > Security > Edit > Add. Click Locations, then scroll up to the top. It should show the domain controller. You can also perform a packet capture to confirm which DC. – Greg Askew Jun 14 '17 at 15:09
  • There is no security filtering enabled, I have 2 DCs and 3 RODCs, dcdiag passed all tests – Root Loop Jun 14 '17 at 15:13
  • @greg askew , looks like the servers that can't apply computer settings are getting GPOs from those 3 read-only DCs. How can I specify which DC to get GPO from? – Root Loop Jun 14 '17 at 15:20
3

Need to fix fix sysvol replication with your RODC's or the client's will be unable to access the current policies.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.