The processing of Group Policy failed because of lack of network connectivity to a domain controller

Question

We are setting up a new AD environment  with one AD/DC running DNS services,  and a secondary DNS server configured with secondary zone. The problem is that none of the machines in the the domain are getting GPO.
When I run a gpupdate /force from a machine, I get the following output:
"Updating Policy...
User Policy update has completed successfully.
Computer policy could not be updated successfully. The following errors were enc
ountered:
The processing of Group Policy failed because of lack of network connectivity to
 a domain controller. This may be a transient condition. A success message would
 be generated once the machine gets connected to the domain controller and Group
 Policy has succesfully processed. If you do not see a success message for sever
al hours, then contact your administrator.
To diagnose the failure, review the event log or run GPRESULT /H GPReport.html f
rom the command line to access information about Group Policy results."
While the system event log outputs the following:
"The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy
has succesfully processed. If you do not see a success message for several hours, then contact your administrator." 
All the machines that were joined to the domain are able to resolve in forward and reverse lookups, ping the DC and ping each other so  I dont understand how the error can be resolved.
Here are few things I have tried:
1. I came across this KB which checked ok for me: http://support.microsoft.com/kb/241515
2. Made a copy of the default GPO, applied to a OU with one machine, and made sure to remove any GPO links from above
3. Enabled the following  two local Group policies on a test member:
GP slow link detection
Startup policy processing wait time
4. Modified firewall to allow everything on both member and DC
5. Verified DSN logs, SRV records, access to sysvol ( added authenticated users to sysvol)
I have yet to figure out the reason for this issue. Has anyone seen anything like this before?

Answer 1

1. I checked the NIC, it only has one IP. and I followed your article. I set the primary DNS to its own IP and the secondary DNS to the loopback ip
2. This is a new DC and DNS server. I dont have old records yet. I also check the DNS event logs. No errors
3. I made sure the member server is pointing only to the only DC/DNS server
4. Here is the output from the dcdiag....  everything passed except, the Netlogons part. I'm not sure what means or how to fix it yet:
      Starting test: NetLogons
         * Warning BUILTIN\Administrators did not have the "Access this
         computer
         "*   from network" right.
         [hostname] An net use or LsaPolicy operation failed with error
         1, Incorrect function..
         ......................... hostname failed test NetLogons
Complete output:
> hostname
Server:  hostname.domain.local
Address:  X.X.X.95
> ^C
C:\Windows\system32>
C:\Windows\system32>nslookup
> set type=all
>
>
>
> _ldap._tcp.dc._msdcs.domainname
_ldap._tcp.dc._msdcs.domain.local SRV service location:
          priority       = 0
          weight         = 100
          port           = 389
          svr hostname   = hostname.domain.local
hostname.domain.local      internet address = X.X.X.95
> ^C
C:\Windows\system32>cd ..
C:\Windows>cd SYSVOL
C:\Windows\SYSVOL>cd sysvol
C:\Windows\SYSVOL\sysvol>dir
 Volume in drive C has no label.
 Volume Serial Number is F624-CDB2
 Directory of C:\Windows\SYSVOL\sysvol
10/29/2014  08:25 PM    <DIR>          .
10/29/2014  08:25 PM    <DIR>          ..
10/29/2014  08:25 PM    <JUNCTION>     domain.local [C:\Windows\SYSVOL\domain]
               0 File(s)              0 bytes
               3 Dir(s)  63,971,037,184 bytes free
C:\Windows\SYSVOL\sysvol>dcdiag
Directory Server Diagnosis
Performing initial setup:
   Trying to find home server...
   Home Server = hostname
   * Identified AD Forest.
   Done gathering initial info.
Doing initial required tests
   Testing server: Default-First-Site-Name\hostname
      Starting test: Connectivity
         ......................... hostname passed test Connectivity
Doing primary tests
   Testing server: Default-First-Site-Name\hostname
      Starting test: Advertising
         ......................... hostname passed test Advertising
      Starting test: FrsEvent
         ......................... hostname passed test FrsEvent
      Starting test: DFSREvent
         ......................... hostname passed test DFSREvent
      Starting test: SysVolCheck
         ......................... hostname passed test SysVolCheck
      Starting test: KccEvent
         ......................... hostname passed test KccEvent
      Starting test: KnowsOfRoleHolders
         ......................... hostname passed test
         KnowsOfRoleHolders
      Starting test: MachineAccount
         ......................... hostname passed test MachineAccount
      Starting test: NCSecDesc
         ......................... hostname passed test NCSecDesc
      Starting test: NetLogons
         * Warning BUILTIN\Administrators did not have the "Access this
         computer
         "*   from network" right.
         [hostname] An net use or LsaPolicy operation failed with error
         1, Incorrect function..
         ......................... hostname failed test NetLogons
      Starting test: ObjectsReplicated
         ......................... hostname passed test
         ObjectsReplicated
      Starting test: Replications
         ......................... hostname passed test Replications
      Starting test: RidManager
         ......................... hostname passed test RidManager
      Starting test: Services
         ......................... hostname passed test Services
      Starting test: SystemLog
         A warning event occurred.  EventID: 0x000003F6
            Time Generated: 03/04/2015   18:23:06
            Event String:
            Name resolution for the name ctldl.windowsupdate.com timed out after
 none of the configured DNS servers responded.
         ......................... hostname passed test SystemLog
      Starting test: VerifyReferences
         ......................... hostname passed test VerifyReferences
   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation
   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation
   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
   Running partition tests on : emcdsm
      Starting test: CheckSDRefDom
         ......................... emcdsm passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... emcdsm passed test CrossRefValidation
   Running enterprise tests on : domain.local
      Starting test: LocatorCheck
         ......................... domain.local passed test LocatorCheck
      Starting test: Intersite
         ......................... domain.local passed test Intersite
C:\Windows\SYSVOL\sysvol>