I have a solution with two domain controllers. Domain is COMPANY.CLOUD We're trying to apply some group policies at the domain level, but things don't seem to be working correctly.

On COMPANY-DC1, If I add some policy definitions (ADMX) to \COMPANY.CLOUD\SYSVOL\COMPANY.CLOUD\Policies\PolicyDefinitions, they are not visible from the session host servers. I've checked in C:\Windows\PolicyDefinitions on both COMPANY-DC1 and COMPANY-DC2 and those definitions are not there; although I suspect there is a central location for these so that isn't necessarily an issue.

What IS an issue, however, is that when I create a group policy to be applied to the session host servers and run gpupdate on the session hosts servers, they initially fail to gpupdate as they cannot locate the files for the new policy. A path is given that it is trying to read from and I can manually copy the required files there, which then allows gpupdate to complete, however the policy isn't applied and running RSOP actually errors because it cant see the necessary resource files etc.

It basically feels like the domain isn't syncing correctly between the two domain controllers, but I'm not sure; I've not come across this kind of misbehaving before and I'm not sure how best to diagnose it.

Can anyone point me in the right direction for any tests I can do to identify domain issues?

Thanks in advance.

  • Sounds like a broken SYSVOL replication. Do you use DFS for replication? Anything in the eventlogs (other than the failed GPOs)? Output of repadmin /replsummary? – Lenniey Jan 4 '18 at 13:58
  • Thanks @Lenniey - DCDiag shows the following.... Starting test: DFSREvent There are warning or error events within the last 24 hours after the SYSVOL has been shared. Failing SYSVOL replication problems may cause Group Policy problems. – John Jan 4 '18 at 15:22
  • I havent set up DFS as such - we had 1 domain controller, then we promoted another machine and now we have two :) – John Jan 4 '18 at 15:24
  • I've looked in the event viewer and can see DFS replication errors every night at around the time our backups kick in, but it does say that it will retry periodically, and it must do because it errors again the next day which tells me its restarting – John Jan 4 '18 at 15:44
  • Did you verify that SYSVOL replicated to the new Domain Controller? My guess is that it didn't and that you have an NTFRS Journal Wrap error on your original Domain Controller. – joeqwerty Jan 4 '18 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.