Active-X update group policy problem

I am having problems distributing
install_flash_player_active_x.msi via a group policy in our MS AD.
I am familiar with creating GPOs. I used a GPO to distribute
Adobe Reader without any problems, but this active-X update will
not apply via a gpo. The error I get is: The install of application
Adobe Flash Player 9 ActiveX (2) from policy Adobe_Flash_Patch
failed. The error was : The installation source for this product is
not available. Verify that the source exists and that you can
access it.
I created an administration install and used the same shared
distribution folder as I did for Adobe Reader so I know that this
error is not due to permissions. Any help would be gratefully
appreciated.

>  9. The Database Security Editor appears. You need to add the user or
>     group that you want the *Security* tab to be removed from.
What EXACT group was entered in your GPO there?
And if you want to revert, it is most probably NOT sufficient to simply
unlink the GPO, but you need to implement a second GPO that grants the
required read rights (aka "removes the deny entry")
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Similar Messages

  • How to update group policy on MAC OS 10.6.8

    Hi,
    I am not able to update group policy on MAC 10.6.8 like gpupdate comand from terminal.
    Regards
    Govind Singh

    OK, makes sense. Any idea what the DMG preference should be in Firefox?
    It was set to "Always Ask"
    ... and I changed it to "Use MacOS"
    The funny thing is that all the other updates (these were Add On updates) that I ran downloaded the DMG file and it started right up. It is only the Adobe products (Acroread, Flash, ect) that are having troubles, and they all get the same error.
    BTW - Thanks for helping!
    NEW UPDATE:
    Found /System/Library/CoreServices/DiskImageMounter.app and set the Firefox preferences DMG file to use that now.

  • How do I setup Active Directory and Group Policy on Windows Server 2012?

    I work for a school district that uses a Windows 2012 server with about 400 Windows 7 PCs and 150 Mac PCs. We are set up with Roaming Profiles on the PCs and would like to be able to setup Active Directory, Group Policy, and Roaming Profiles on our macs. (We also have a mac server that they are using as a file server only) As we are a school, our funds are very low. Now for the questions...
    Is there a software that allow us to accomplish this?
    Is there a free solution or a very reduced price option to do this?
    I heard that http://www.centrify.com/products/mac-edition.asp may accomplish this and I read something about it on here but didn't know if this is what I was really trying to do becuase it was marked as "The Golden Triangle" and did not mention Raoming Profiles. This is the link though: https://discussions.apple.com/message/17200059#17200059
    Any help would be greatly appreciated.

    The above reply does not take into account that I am trying to use GROUP POLICY EDITOR to make it the default browser.

  • Error while updating Group Policy

    Hello All,
    I get the below error while updating the group policy on the user machin.
    C:\Users\905288>gpupdate /force
    Updating Policy...
    User Policy update has completed successfully.
    The following warnings were encountered during user policy processing:
    Windows failed to apply the Internet Explorer Zonemapping settings. Internet Exp
    lorer Zonemapping settings might have its own log file. Please click on the "Mor
    e information" link.
    Computer Policy update has completed successfully.
    For more detailed information, review the event log or run GPRESULT /H GPReport.
    html from the command line to access information about Group Policy results.
    Is there a way I can find which group policy is causing this issue?

    > Do you want me to give you those site details as well?
    Hm - not really, I have no error with zone assignments. It's you with
    the error :)
    Verify your site entries against
    http://support.microsoft.com/kb/184456
    - most probably, some of them do not adhere to the allowed wildcard rules.
    Martin
    Mal ein
    GUTES Buch über GPOs lesen?
    NO THEY ARE NOT EVIL, if you know what you are doing:
    Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))

  • SCCM 2012 Update Group inconsistency Problem with Red marked Updates

    Hi everybody,
    we have a big Problem with our SCCM 2012 R2 CU3 Enviroment, regarding of Update Groups which got out of sync.
    we have a SCCM Site Infastructure with one CAS and 4 Primary Sites and on every Site is the SUP Role installed.
    I don't know when this failure occours but i think it was after the CU3 Installation. The Installation itself went smooth without any Errors or Warnings.
    The Problem is as following. We have some updates in Update Groups (all of them are Core XML Updates) which are out of sync and marked red as an invalid Update on 2 Primary Sites. On the CAS Site and the 2 other Primary SItes they are marked as green (downloaded
    yes and deployed yes)
    We have no Replication issues regarding the Replication Status (everything is synchronized to 100%) and the Replication Link Analyzer does also show no Problems at all.
    I now deleted the Deployments and the SW Update Group waited until the replication was fine and created a new one and downloaded these patches on one of the Primary Sites which had shown this Failure.
    The Result was not good. It looks like before. On the CAS and 2 Primary Sites the Deplyment is shown as downloaded but on the other 2 Sites the Status is again Downloaded=no.
    Does anybody have any idea what to do now ? I checked objmgr.log and rcmctr. log but found nothing what shows me the way in the right direction.
    Thx for your time, and it would be fine if anybody can share knowledge about this failure and how to fix it.
    All other Ideas are also welcome.
    Thx a lot in advance and have a nice bug free day :-)
    Bastian

    Hi,
    Please try to manually synchronize software updates from the CAS and monitor the WSUSCtrl.log, WCM.log and wsyncmgr.log on the CAS and Primary sites.
    Best Regards,
    Joyce
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Wireless Group Policy Problem - Half the policy applying

    Hi
    I'm at a loss for where to investigate this one so I'm hoping for some suggestions.
    We have a single GPO to send out settings for wireless access to our network. On the wireless we have two SSIDs as below.
    1. Staff SSID
    My manager wanted to reduce the security issues with this as much as possible, so I've generated a GUID for the SSID name, set it not to broadcast the SSID and set the group policy to show the network as "<company
    name> Staff". It uses WPA2-Enterprise with RADUIS authentication to silently pass the authentication credentials of the currently logged on user providing SSO.
    2. Guests SSID
    This uses a preshared WPA2 key and provides guests with internet access and is blocked from the local LAN.
    The GPO is applied in such a way that company laptops are have the Staff SSID displayed in the available connection list, they're allowed to connect to it (as long as they're in the appropriate AD group for RADIUS authentication) but they are blocked from
    connecting their laptops to the Guests SSID. The important thing is that this single GPO controls both settings.
    On a few laptops we have been noticing that the blocking of the Guests SSID is working fine, but the Staff SSID is failing to show. Its as if only half the policy is applying. This is happening to only a small number of laptops which reside in the same AD
    OUs and it doesn't matter who logs on, the same problem occurs. The laptop is able to view all other wireless networks in the vicinity.
    I have logged in to one as myself (with Domain Admin permissions) and I get this problem, but on other laptops, the policy applies completely allowing me to connect to the Staff SSID while blocking the Guests SSID, as it should.
    I've run a RSOP against the laptop which shows that the policy is applying (confirmed by the fact that the Guests SSID is blocked) and the only problem I can find in the event logs are for the EapHost service with event ID of 2002. I've followed the advice
    in a few forum posts below but have been unsucccessful (not even sure if it's related to the GPO issue).
    http://www.eventid.net/display-eventid-2002-source-Microsoft-Windows-EapHost-eventno-10874-phase-1.htm
    http://www.sevenforums.com/network-sharing/336450-event-id-2002-source-eaphost-eap-method-dll-path-name-failed.html
    Any suggestion would be greatly appreciated.

    Hi Daverino,
    Since RSOP shows that the policy has been applied, it should not be a grouppolicy issue.
    According yourdescription, it seems that the system of the laptop has been changedby the user data.
    Could you please post the original information about event 2002? It is useful for further troubleshooting.
    Best Regards.
    Steven Lee
    TechNet Community Support

  • Windows Update Group Policy Settings?

    I browsed through SCCM 2012 documentation for an answer of what to set in a GPO when wanting to use SCCM 2012 SP1 to handle updates.
    At the moment I have:
    WSUS/Reporting pointing to wsus server and its appropriate ports
    Allow Automatic Updates immediate installation: Enabled
    All signed updates from intranet Microsoft Updates: Enabled
    Configure Automatic Updates: Enabled
      Configure automatic Updating - 4 Auto download and schedule the install
      Scheduled install day: Every Friday
      Scheduled install time: 21:00
    Enabling Windows Update Power Management to auto wakeup the system to install Enabled
    No auto-restart with logged on users for scheduled automatic updates installations: Enabled
    Reschedule Automatic Updates scheduled installation: Disabled
    I didn't see any hint, perhaps it is there and I missed it, on what might be the prescribed settings for a GPO.
    What is happening is Windows 8ish is drawing a band across the screen and reporting that your computer needs to reboot; and then reboots.  From what I could tell in the WindowsUpdate.log file is that round the time it was observed rebooting smsexec
    requested a reboot. But oddly I also saw in the Windows Update log was a reboot was scheduled to expire on the 26th, two days after the observed behavior and I also saw that other reboot requests either expired or had been scheduled.
    What I have recently done to various Windows Update deployments was to remove the check boxes for Deadline behavior to prevent Software Updates and System restarts outside the Maintenance Window and also checked Device restart behavior
    Suppress system restart on the following devices Servers and Workstations.
    At the moment I would like to figure out what the GPO settings should be and also how to determine what had requested reboot and when and if the reboot actually happened.
    Thanks!

    This blog series by Jason should help you with that (it's still applicable):
    http://blog.configmgrftw.com/software-update-management-and-group-policy-for-configmgr-what-else/
    http://blog.configmgrftw.com/software-updates-management-and-group-policy-for-configmgr-cont/
    My Blog: http://www.petervanderwoude.nl/
    Follow me on twitter: pvanderwoude

  • MBAM Group Policy Problems

    I am trying to install and configure MBAM 2.0. I have installed all of the components on two separate servers. Server 1 has sccm 2012
    integration and gpo policy templates. Server two has the rest. When I load Group Policy Management the templates do not appear. I have manually extracted and copied the templates in the local policy definitions and still nothing. Any ideas?

    By default the Group Policy Management console will look for templates at a central SYSVOL location (a so called central store). Likely you have a PolicyDefinitions folder in
    \\domain.com\sysvol\domain.com\Policies and then you need to add the MBAM ADMX and ADML files to that location to be able to see those settings when managing group policies. The reason for this is
    that the central store has precedence over local group policy templates.
    Blogging about Windows for IT pros at
    www.theexperienceblog.com

  • Launch problem opening PSE 13 from a read only desktop applied by group policy

    PSE 13 won't launch.  What is different between opening PSE 13 and other programs? On a normal login it opens. Are there special requirements?

    Hi,
    Thanks for posting your issue in the forum.
    Based on your description, I suspect that maybe Software Restriction Policy has been configured in the domain. At this time, I suggest we could try to collect the following information to narrow
    down the cause of the issue.
    GPMC.log
    ==================
    a. On domain controller, click Start ->Run, type GPMC.MSC, it will load the GPMC console.
    b. Right click on "Group Policy Result" and choose wizard to generate a report for the problematic computer and user account (please place appropriately). (Choose computer and select the proper
    user in the wizard)
    c. Right click 
    the resulting group policy result and click the "Save Report…" => save report to save the report to a HTML file.
    Once we get the report, please check if the Software Restriction Policy has been configured and applied to the problematic computers and users. If so, please disable the policy setting to see
    if the issue persists.
    In addition, please try to refer to the following articles for detailed information about Software Restriction Policy and how to troubleshoot Group Policy problems.
    Software Restriction Policies
    http://technet.microsoft.com/en-us/library/hh831534.aspx
    Troubleshooting Group Policy Problems
    http://technet.microsoft.com/en-us/library/cc787386(v=ws.10).aspx
    Hope this helps.
    Best Regards,
    Andy Qi
    TechNet Subscriber Support
    If you are
    TechNet Subscription user and have any feedback
    on our support quality, please send your feedback here.
    Andy Qi
    TechNet Community Support

  • Group Policy processing failure on 2008 when MIX Domain 2003 with DC 2008

    Dear I try to add additional Windows 2008 Domain to My Domain controller 2003  and I ma Receiving Group policy error in DC 2008  With Event ID 1055
    The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: 
    a) Name Resolution failure on the current domain controller. 
    b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
    - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
    - <System>
      <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" /> 
      <EventID>1055</EventID> 
      <Version>0</Version> 
      <Level>2</Level> 
      <Task>0</Task> 
      <Opcode>1</Opcode> 
      <Keywords>0x8000000000000000</Keywords> 
      <TimeCreated SystemTime="2014-03-06T14:36:44.411955300Z" /> 
      <EventRecordID>3859</EventRecordID> 
      <Correlation ActivityID="{28DAD258-26D0-4C1E-A4B7-F37DEE04C8F1}" /> 
      <Execution ProcessID="952" ThreadID="3276" /> 
      <Channel>System</Channel> 
      <Computer>PRIMARYDC.Qtit.com</Computer> 
      <Security UserID="S-1-5-18" /> 
      </System>
    - <EventData>
      <Data Name="SupportInfo1">1</Data> 
      <Data Name="SupportInfo2">1632</Data> 
      <Data Name="ProcessingMode">0</Data> 
      <Data Name="ProcessingTimeInMilliseconds">1578</Data> 
      <Data Name="ErrorCode">5</Data> 
      <Data Name="ErrorDescription">Access is denied.</Data> 
      </EventData>
      </Event>
    I install See KB939820 for a hotfix applicable to Microsoft DC 2003 regrading to he KRBTGT account 
    Refer Url : http://support.microsoft.com/kb/939820 
    I run dcdiag /v on  and repadmin /showrepl at DC 2008
    the dcdiag /v result
    Directory Server Diagnosis
    Performing initial setup:
       Trying to find home server...
       * Verifying that the local machine PRIMARYDC, is a Directory Server. 
       Home Server = PRIMARYDC
       * Connecting to directory service on server PRIMARYDC.
       * Identified AD Forest. 
       Collecting AD specific global data 
       * Collecting site info.
       Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=Qtit,DC=com,LDAP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......
       The previous call succeeded 
       Iterating through the sites 
       Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Qtit,DC=com
       Getting ISTG and options for the site
       * Identifying all servers.
       Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=Qtit,DC=com,LDAP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......
       The previous call succeeded....
       The previous call succeeded
       Iterating through the list of servers 
       Getting information for the server CN=NTDS Settings,CN=SECONDAD,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Qtit,DC=com 
       objectGuid obtained
       InvocationID obtained
       dnsHostname obtained
       site info obtained
       All the info for the server collected
       Getting information for the server CN=NTDS Settings,CN=PRIMARYDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Qtit,DC=com 
       objectGuid obtained
       InvocationID obtained
       dnsHostname obtained
       site info obtained
       All the info for the server collected
       * Identifying all NC cross-refs.
       * Found 2 DC(s). Testing 1 of them.
       Done gathering initial info.
    Doing initial required tests
       Testing server: Default-First-Site-Name\PRIMARYDC
          Starting test: Connectivity
             * Active Directory LDAP Services Check
             Determining IP4 connectivity 
             * Active Directory RPC Services Check
             ......................... PRIMARYDC passed test Connectivity
    Doing primary tests
       Testing server: Default-First-Site-Name\PRIMARYDC
          Starting test: Advertising
             The DC PRIMARYDC is advertising itself as a DC and having a DS.
             The DC PRIMARYDC is advertising as an LDAP server
             The DC PRIMARYDC is advertising as having a writeable directory
             The DC PRIMARYDC is advertising as a Key Distribution Center
             The DC PRIMARYDC is advertising as a time server
             The DS PRIMARYDC is advertising as a GC.
             ......................... PRIMARYDC passed test Advertising
          Test omitted by user request: CheckSecurityError
          Test omitted by user request: CutoffServers
          Starting test: FrsEvent
             * The File Replication Service Event log test 
             There are warning or error events within the last 24 hours after the
             SYSVOL has been shared.  Failing SYSVOL replication problems may cause
             Group Policy problems. 
             A warning event occurred.  EventID: 0x800034C8
                Time Generated: 03/06/2014   10:18:56
                Event String:
                The File Replication Service has detected an enabled disk write cache on the drive containing the directory c:\windows\ntfrs\jet on the computer PRIMARYDC. The File Replication Service might not recover when power to
    the drive is interrupted and critical updates are lost.
             A warning event occurred.  EventID: 0x800034C8
                Time Generated: 03/06/2014   10:53:21
                Event String:
                The File Replication Service has detected an enabled disk write cache on the drive containing the directory c:\windows\ntfrs\jet on the computer PRIMARYDC. The File Replication Service might not recover when power to
    the drive is interrupted and critical updates are lost.
             ......................... PRIMARYDC passed test FrsEvent
          Starting test: DFSREvent
             The DFS Replication Event Log. 
             Skip the test because the server is running FRS.
             ......................... PRIMARYDC passed test DFSREvent
          Starting test: SysVolCheck
             * The File Replication Service SYSVOL ready test 
             File Replication Service's SYSVOL is ready 
             ......................... PRIMARYDC passed test SysVolCheck
          Starting test: KccEvent
             * The KCC Event log test
             Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
             ......................... PRIMARYDC passed test KccEvent
          Starting test: KnowsOfRoleHolders
             Role Schema Owner = CN=NTDS Settings,CN=SECONDAD,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Qtit,DC=com
             Role Domain Owner = CN=NTDS Settings,CN=SECONDAD,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Qtit,DC=com
             Role PDC Owner = CN=NTDS Settings,CN=SECONDAD,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Qtit,DC=com
             Role Rid Owner = CN=NTDS Settings,CN=SECONDAD,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Qtit,DC=com
             Role Infrastructure Update Owner = CN=NTDS Settings,CN=SECONDAD,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Qtit,DC=com
             ......................... PRIMARYDC passed test KnowsOfRoleHolders
          Starting test: MachineAccount
             Checking machine account for DC PRIMARYDC on DC PRIMARYDC.
             * SPN found :LDAP/PRIMARYDC.Qtit.com/Qtit.com
             * SPN found :LDAP/PRIMARYDC.Qtit.com
             * SPN found :LDAP/PRIMARYDC
             * SPN found :LDAP/PRIMARYDC.Qtit.com/QTIT
             * SPN found :LDAP/e3d8c76c-1b59-4de6-9f7f-c438df9a2863._msdcs.Qtit.com
             * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/e3d8c76c-1b59-4de6-9f7f-c438df9a2863/Qtit.com
             * SPN found :HOST/PRIMARYDC.Qtit.com/Qtit.com
             * SPN found :HOST/PRIMARYDC.Qtit.com
             * SPN found :HOST/PRIMARYDC
             * SPN found :HOST/PRIMARYDC.Qtit.com/QTIT
             * SPN found :GC/PRIMARYDC.Qtit.com/Qtit.com
             ......................... PRIMARYDC passed test MachineAccount
          Starting test: NCSecDesc
             * Security Permissions check for all NC's on DC PRIMARYDC.
             The forest is not ready for RODC. Will skip checking ERODC ACEs.
             * Security Permissions Check for
               DC=ForestDnsZones,DC=Qtit,DC=com
                (NDNC,Version 3)
             Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have 
                Replicating Directory Changes In Filtered Set
             access rights for the naming context:
             DC=ForestDnsZones,DC=Qtit,DC=com
             * Security Permissions Check for
               DC=DomainDnsZones,DC=Qtit,DC=com
                (NDNC,Version 3)
             Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have 
                Replicating Directory Changes In Filtered Set
             access rights for the naming context:
             DC=DomainDnsZones,DC=Qtit,DC=com
             * Security Permissions Check for
               CN=Schema,CN=Configuration,DC=Qtit,DC=com
                (Schema,Version 3)
             * Security Permissions Check for
               CN=Configuration,DC=Qtit,DC=com
                (Configuration,Version 3)
             * Security Permissions Check for
               DC=Qtit,DC=com
                (Domain,Version 3)
             ......................... PRIMARYDC failed test NCSecDesc
          Starting test: NetLogons
             * Network Logons Privileges Check
             Verified share \\PRIMARYDC\netlogon
             Verified share \\PRIMARYDC\sysvol
             ......................... PRIMARYDC passed test NetLogons
          Starting test: ObjectsReplicated
             PRIMARYDC is in domain DC=Qtit,DC=com
             Checking for CN=PRIMARYDC,OU=Domain Controllers,DC=Qtit,DC=com in domain DC=Qtit,DC=com on 1 servers
                Object is up-to-date on all servers.
             Checking for CN=NTDS Settings,CN=PRIMARYDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Qtit,DC=com in domain CN=Configuration,DC=Qtit,DC=com on 1 servers
                Object is up-to-date on all servers.
             ......................... PRIMARYDC passed test ObjectsReplicated
          Test omitted by user request: OutboundSecureChannels
          Starting test: Replications
             * Replications Check
             * Replication Latency Check
                DC=ForestDnsZones,DC=Qtit,DC=com
                   Latency information for 18 entries in the vector were ignored.
                      18 were retired Invocations.  0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc.  0 had no latency information (Win2K DC).  
                DC=DomainDnsZones,DC=Qtit,DC=com
                   Latency information for 18 entries in the vector were ignored.
                      18 were retired Invocations.  0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc.  0 had no latency information (Win2K DC).  
                CN=Schema,CN=Configuration,DC=Qtit,DC=com
                   Latency information for 20 entries in the vector were ignored.
                      20 were retired Invocations.  0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc.  0 had no latency information (Win2K DC).  
                CN=Configuration,DC=Qtit,DC=com
                   Latency information for 20 entries in the vector were ignored.
                      20 were retired Invocations.  0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc.  0 had no latency information (Win2K DC).  
                DC=Qtit,DC=com
                   Latency information for 20 entries in the vector were ignored.
                      20 were retired Invocations.  0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc.  0 had no latency information (Win2K DC).  
             * Replication Site Latency Check 
             ......................... PRIMARYDC passed test Replications
          Starting test: RidManager
             * Available RID Pool for the Domain is 14607 to 1073741823
             * SecondAD.Qtit.com is the RID Master
             * DsBind with RID Master was successful
             * rIDAllocationPool is 14107 to 14606
             * rIDPreviousAllocationPool is 14107 to 14606
             * rIDNextRID: 14124
             ......................... PRIMARYDC passed test RidManager
          Starting test: Services
             * Checking Service: EventSystem
             * Checking Service: RpcSs
             * Checking Service: NTDS
             * Checking Service: DnsCache
             * Checking Service: NtFrs
             * Checking Service: IsmServ
             * Checking Service: kdc
             * Checking Service: SamSs
             * Checking Service: LanmanServer
             * Checking Service: LanmanWorkstation
             * Checking Service: w32time
             * Checking Service: NETLOGON
             ......................... PRIMARYDC passed test Services
          Starting test: SystemLog
             * The System Event log test
             A warning event occurred.  EventID: 0x0000A001
                Time Generated: 03/06/2014   16:04:05
                Event String:
                The Security System could not establish a secured connection with the server ldap/PRIMARYDC.Qtit.com/[email protected]. No authentication protocol was available.
             An error event occurred.  EventID: 0x0000041F
                Time Generated: 03/06/2014   16:06:35
                Event String:
                The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: 
                a) Name Resolution failure on the current domain controller. 
                b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
             An error event occurred.  EventID: 0x0000041F
                Time Generated: 03/06/2014   16:11:36
                Event String:
                The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: 
                a) Name Resolution failure on the current domain controller. 
                b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
             An error event occurred.  EventID: 0x0000041F
                Time Generated: 03/06/2014   16:16:38
                Event String:
                The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: 
                a) Name Resolution failure on the current domain controller. 
                b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
             An error event occurred.  EventID: 0x0000041F
                Time Generated: 03/06/2014   16:21:39
                Event String:
                The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: 
                a) Name Resolution failure on the current domain controller. 
                b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
             An error event occurred.  EventID: 0x0000041F
                Time Generated: 03/06/2014   16:26:41
                Event String:
                The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: 
                a) Name Resolution failure on the current domain controller. 
                b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
             An error event occurred.  EventID: 0x00000457
                Time Generated: 03/06/2014   16:30:46
                Event String:
                Driver TOSHIBA e-STUDIO16/20/25 PCL 6 required for printer TOSHIBA e-STUDIO16/20/25 PCL 6 is unknown. Contact the administrator to install the driver before you log in again.
             An error event occurred.  EventID: 0x00000457
                Time Generated: 03/06/2014   16:30:48
                Event String:
                Driver Microsoft XPS Document Writer v4 required for printer Microsoft XPS Document Writer is unknown. Contact the administrator to install the driver before you log in again.
             An error event occurred.  EventID: 0x00000457
                Time Generated: 03/06/2014   16:30:49
                Event String:
                Driver Send to Microsoft OneNote 15 Driver required for printer Send To OneNote 2013 is unknown. Contact the administrator to install the driver before you log in again.
             An error event occurred.  EventID: 0x00000457
                Time Generated: 03/06/2014   16:31:14
                Event String:
                Driver Send to Microsoft OneNote 15 Driver required for printer Send To OneNote 2013 is unknown. Contact the administrator to install the driver before you log in again.
             An error event occurred.  EventID: 0x00000457
                Time Generated: 03/06/2014   16:31:16
                Event String:
                Driver Microsoft XPS Document Writer v4 required for printer Microsoft XPS Document Writer is unknown. Contact the administrator to install the driver before you log in again.
             An error event occurred.  EventID: 0x00000457
                Time Generated: 03/06/2014   16:31:16
                Event String:
                Driver WebEx Document Loader required for printer WebEx Document Loader is unknown. Contact the administrator to install the driver before you log in again.
             An error event occurred.  EventID: 0x0000041F
                Time Generated: 03/06/2014   16:31:42
                Event String:
                The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: 
                a) Name Resolution failure on the current domain controller. 
                b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
             ......................... PRIMARYDC failed test SystemLog
          Test omitted by user request: Topology
          Test omitted by user request: VerifyEnterpriseReferences
          Starting test: VerifyReferences
             The system object reference (serverReference)
             CN=PRIMARYDC,OU=Domain Controllers,DC=Qtit,DC=com and backlink on
             CN=PRIMARYDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Qtit,DC=com
             are correct. 
             The system object reference (serverReferenceBL)
             CN=PRIMARYDC,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=Qtit,DC=com
             and backlink on
             CN=NTDS Settings,CN=PRIMARYDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=Qtit,DC=com
             are correct. 
             The system object reference (frsComputerReferenceBL)
             CN=PRIMARYDC,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=Qtit,DC=com
             and backlink on CN=PRIMARYDC,OU=Domain Controllers,DC=Qtit,DC=com are
             correct. 
             ......................... PRIMARYDC passed test VerifyReferences
          Test omitted by user request: VerifyReplicas
          Test omitted by user request: DNS
          Test omitted by user request: DNS
       Running partition tests on : ForestDnsZones
          Starting test: CheckSDRefDom
             ......................... ForestDnsZones passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... ForestDnsZones passed test
             CrossRefValidation
       Running partition tests on : DomainDnsZones
          Starting test: CheckSDRefDom
             ......................... DomainDnsZones passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... DomainDnsZones passed test
             CrossRefValidation
       Running partition tests on : Schema
          Starting test: CheckSDRefDom
             ......................... Schema passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... Schema passed test CrossRefValidation
       Running partition tests on : Configuration
          Starting test: CheckSDRefDom
             ......................... Configuration passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... Configuration passed test CrossRefValidation
       Running partition tests on : Qtit
          Starting test: CheckSDRefDom
             ......................... Qtit passed test CheckSDRefDom
          Starting test: CrossRefValidation
             ......................... Qtit passed test CrossRefValidation
       Running enterprise tests on : Qtit.com
          Test omitted by user request: DNS
          Test omitted by user request: DNS
          Starting test: LocatorCheck
             GC Name: \\PRIMARYDC.Qtit.com
             Locator Flags: 0xe00031fc
             PDC Name: \\SecondAD.Qtit.com
             Locator Flags: 0xe00001bd
             Time Server Name: \\PRIMARYDC.Qtit.com
             Locator Flags: 0xe00031fc
             Preferred Time Server Name: \\PRIMARYDC.Qtit.com
             Locator Flags: 0xe00031fc
             KDC Name: \\PRIMARYDC.Qtit.com
             Locator Flags: 0xe00031fc
             ......................... Qtit.com passed test LocatorCheck
          Starting test: Intersite
             Skipping site Default-First-Site-Name, this site is outside the scope
             provided by the command line arguments provided. 
             ......................... Qtit.com passed test Intersite
    repadmin /showrepl Result
    ******************************8
    ==== INBOUND NEIGHBORS ===================================
    DC=Qtit,DC=com
        Default-First-Site-Name\SECONDAD via RPC
            DSA object GUID: c5ef6e17-77f0-43f6-8d39-5497c563f
            Last attempt @ 2014-03-06 16:41:04 was successful.
    CN=Configuration,DC=Qtit,DC=com
        Default-First-Site-Name\SECONDAD via RPC
            DSA object GUID: c5ef6e17-77f0-43f6-8d39-5497c563f
            Last attempt @ 2014-03-06 16:41:39 was successful.
    CN=Schema,CN=Configuration,DC=Qtit,DC=com
        Default-First-Site-Name\SECONDAD via RPC
            DSA object GUID: c5ef6e17-77f0-43f6-8d39-5497c563f
            Last attempt @ 2014-03-06 15:53:01 was successful.
    DC=DomainDnsZones,DC=Qtit,DC=com
        Default-First-Site-Name\SECONDAD via RPC
            DSA object GUID: c5ef6e17-77f0-43f6-8d39-5497c563f
            Last attempt @ 2014-03-06 16:27:31 was successful.
    DC=ForestDnsZones,DC=Qtit,DC=com
        Default-First-Site-Name\SECONDAD via RPC
            DSA object GUID: c5ef6e17-77f0-43f6-8d39-5497c563f
            Last attempt @ 2014-03-06 15:53:01 was successful.
    I try to down the DC 2003 and access \\Qtit.com it success open the syslog on DC 2008
    Any help or advice 

    Hi,
    Were there other error codes logged in Event Viewer?
    Regarding Event ID 1055, the following article can be referred to for troubleshooting.
    Event ID 1055 — Group Policy Preprocessing (Security)
    http://technet.microsoft.com/en-us/library/cc727272(v=ws.10).aspx
    Based on the report you posted, this issue may be related to FRS replication service. As a result, we can use ntfrsutl tool to check whether the replication service is healthy.
    Regarding this point, the following articles can be referred to for more information.
    Troubleshooting File Replication Service
    http://technet.microsoft.com/en-us/library/bb727056.aspx
    Ntfrsutl
    http://technet.microsoft.com/en-us/library/hh875636.aspx
    In addition, we can also try doing a non-authoritative Sysvol restore on Windows Server 2008 DC to see whether the issue persists.
    Using the BurFlags registry key to reinitialize File Replication Service replica sets
    http://support.microsoft.com/kb/290762/en-us
    Hope it helps.
    Best regards,
    Frank Shen

  • [Forum FAQ] Group Policy Preferences Scheduled Tasks Item not working when the option Run whether user is logged on or not is selected

    Scenario:
    We use one of the following Group Policy Preferences Scheduled Tasks item to deploy a task to clients:
    Computer Configuration -> Control Panel Settings -> Scheduled Tasks -> New -> Scheduled Task (At least Windows 7)
    Computer Configuration -> Control Panel Settings -> Scheduled Tasks -> New -> Immediate Task (At least Windows 7)
    User Configuration -> Control Panel Settings -> Scheduled Tasks -> New -> Scheduled Task (At least Windows 7)
    User Configuration -> Control Panel Settings -> Scheduled Tasks -> New -> Immediate Task (At least Windows 7)
    (Note that on some platforms, "At least Windows 7" is replaced with "Windows Vista and later.")
    After designating a user account to run the task, we select “Run whether user is logged on or not” option, and “The Do not store password…”
    check box is automatically grayed out (See Figure 1).
    Figure 1
    After finishing configuring the task item, on a client, we run command
    gpupdate/force to forcefully update group policy. However, on the client, when we check if the task is listed in Task Scheduler snap-in, the task is not displayed, and when we run
    gpresult/h report.html to collect group policy result for troubleshooting, we see an error as similar as shown in the following figure (Figure 2).
    Figure 2
    Cause:
    To make the scheduled task run whether the user is logged on or not, we need to store the password of the designated user account. However, for the content of the scheduled
    task item is stored in Sysvol where it’s not safe to store passwords, this function has been deprecated.
    Workaround:
    We can run the task with system account
    NT Authority\System, or we can use specific user accounts to run the task when the given user is logged on. (See Figure 3)
    Figure 3
    Reference:
    MS14-025: Vulnerability in Group Policy Preferences could allow elevation of privilege: May 13, 2014
    http://support.microsoft.com/kb/2962486
    Please click to vote if the post helps you. This can be beneficial to other community members reading the thread.

    Hello Everyone,
    Succeeded !!!!!!!
    Even i was struggling with this same Problem to execute a batch via Window scheduler and set the setting to "Run whether the user is logged in or not".
    I tried many time but the batch runs with " Run
    whether user is logged on" and not with "Run
    whether user is logged on or not".
    what i discovered is that there was one mapped drive
    path in my batch file which was not the complete path like y:/AR.qvw actually what i did i changed that map path to the complete path like \\servnamename\d$\AR.qvw and the batch executed successfully with the setting "Run
    whether user is logged on or not"
    The
    conclusion is that check the dependency of the script on external resources because when you check this option "Run
    whether user is logged on or not" It actually conflicts. This my discovery.
    If
    you have any question write me on [email protected]
    Thanks
    & Regards,
    Arun

  • Group Policy Msi status Log

    Hi
      I am embedded developer. i don't have any knowledge about group policy and active directory. I need help ...please
    we are launching msi , from group policy method for all client machine. (that Msi contains silent mode application, application run when msi launch).
    My Question is:
    1.How to i know msi launched successfully in all client machine. if msi could failed in any other client machine, how to i know?
    2. Any other log will be created in server machine? if yes, How to i see that?
    3.  From server, How to i know my application launched successfully in client machine? I wont check all client machine one by one?
    Ranjith

    Hi Ran_619,
    According to my description, you would like to know how to check if the msi was installed sucessfully from the server. Right?
    Based on my knowledge, there are no related logs which can record the result of Windows Installer. You can enable enable software installation logging on the client computer to help you troubleshoot issues that may occur when you install software packages:
    Log on to the administration computer as the administrator.
    Click Start, Run, and then run Regedit to add the following registry value (or modify it, if the value already exists):
    Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics
    Enter the following:
         Value: AppmgmtDebugLevel
        Value Type: REG_DWORD            
        Value Data: 9B (Hexadecimal)
    For your information, please refer to the following artilces to lget more help:
    Enable Logging for Software Installation Client Side Extension
    How to Enable Microsoft Installer logging and Verbose logging to gather additional troubleshooting Information
    Fixing Group Policy problems by using log files
    Regards,
    Lany Zhang

  • Group Policy Guru? Group Policy and Windows 7 erratic and inconsistant.

    (*If you don't feel like reading everything, skip to the bottom two paragraphs for my questions)
    I've had a premier call open with MS since August. This week I had a Microsoft Technician in-house.  Though we eliminated some possibilities, we're not really closer to a cause or solution.
    Every time we work with an expert, I get a different explanation to describe the situation we are viewing.
    Quick summery of the issue:  We've been using Group Policy to manage most Windows XP and 7 settings for years, but starting the middle of last year, we began having clients with machines where some or all group policies would fail to apply. 
    These could be long assigned policies, new polices, or changes to policies.  It would never affect everyone or even a majority at once, and the resolution is never the same.  Sometimes a GPUDPATE /FORCE sometimes fixed automajically the next day,
    sometimes (but very rarely) longer.
    Troubleshooting History:
    What we found in early troubleshooting, that these machines, had errors in Event Viewer for Netlogon, Time-Sync, and Group Policy.  The other issue we noticed, was that our GPRESULT /H reports were missing security groups and the denied section was
    nothing but SSID's.  The first issue pointed me to:
    Event ID 5719 and event ID 1129 may be logged when a non-Microsoft DHCP Relay Agent is used
    I installed these Hot Fixes.  No change to any of the errors in event viewer, or to our Group Policy problems.
    Initial work with Premier Support found that Netlogon, Time-Sync, and Group Policy, were failing before loading of the network stack.  The suggestion was to apply the group policy setting "Always wait for the network at computer startup and
    logon".  At the time, this seemed not to work.  The policy was set on a test bed of laptops and desktops, and no changes in behavior were seen after 3 days.
    Windows 7 Clients intermittently fail to apply group policy at startup
    For some time after this, we were collecting GPSVC and NetTrace logs for Premeir Support, trying to document and troubleshoot the problem.  Eventually we got fed up and asked our TAM to call in a pro to get this resolved.  We were sent an engineer
    for 3 days.  For three days we banged away on this issue.  We verified AD and replication health, we tried numerous fixes and workarounds.  I learned 3 different desriptions of how Group Policy works, and in the end we thought we had a workaround
    using the "Always wait for the network at computer startup and logon" because of a single success late in the day.  On day 3 we tried replicating this fix, and quickly realized that the same issue we were having preventing other GPOs to apply,
    were also preventing our "fix" GPO from applying.  So we went the route of using a registry entry.  I also had a problem that even though it was making the process more consistant, it was still taking 3 reboots for a Computer Policy, assigned
    to a computer object via Security Group, to fully take affect on a computer.
    I used the registry methods in the above article.  It didn't work, no sign it was having the same affect the GPO had had.
    Our support engineer claimed this was the proper method, but that path wasn't even close in a Windows 7 SP1 registry, and after creating all the keys that were not present, it still didn't work.
    Always wait for the network at computer startup and logon - AzureWeb
    We ran out of time, our engineer returned home.
    I can understand how these errors indicate a problem applying Group Policy at boot.  But to me it doesn't explain why it doesn't correct post boot, and after a GPUDPATE /FORCE and a reboot.
    It also doesn't explain why we were working fine for years, then all of a sudden DHCP is being outrun by background services.  (By the way logging showed DHCP wasn't significantly delayed, out boot process was actually excellent, health wise.) 
    Why all of a sudden is this not behaving optimly?  No changes to network design or function.  No changes to the domain since 2008 R2 was installed in 2011.
    Today I'm reading through all these KB's and articles again, and took some time to read:
    [Forum FAQ] Common steps to start troubleshooting Group Policy
    application and it's links below.
    We ran though all of that before and during the 3-day onsite.  It's not getting us any closer to the cause or a solution.
    I found and begin some deep reading in this link today.  It has some additional information I will try to use next week:
    Group Policy Basics - Part 3: How Clients Process GPOs
    The one unanswered question I have is this.  How is group policy supposed to apply to a computer, when that policy is applied to a AD Security Group, in which the computer object is a member?
    Before we began having this problem, we would assign a computer GPO, then ask the user to reboot.  If it were a user GPO, we'd ask the user to log off, or reboot.  Either way, if we allowed a few minutes for AD and FRS replication, the user would
    log back in with that new policy in affect.  A new imaged machine would boot with all the GPO's linked to that domain and assigned to "Authenticated Users", already in affect.  Admin groups would be present in administrators, proxy settings
    would be set in Internet Explorer, etc.
    Now I'm aked to beleive this was never the case from Premeier Support and Microsoft Engineers.  That those policies require the equilent of a "GPUPDATE /FORCE" that was executed by the Local_System account.  That 3 reboots may
    be nessessary for a group policy to be applied.  One for the AD Security Group to be applied.  One for the Computer Policy to be applied.  And a final one for the policy in the GPO to be applied to Windows.
    Can someone confirm or correct this information please?  It's imperitive to my troubleshootng.
    There's no place like 127.0.0.1

    That key is empty on all of my machines I have checked today.  Working and problematic alike.
    GPRESULT logs, when ran as me, historically would show the group polices applied, denied, and the AD group membership all by name.  About 6 months ago I noticed this changed.
    Now they show the applied GPO's by name, a few of the denied GPO's by name, most by SID, and only 2 to 3 AD groups, though PowerShell shows all the AD groups assigned.  This happens after several AD security and distribution groups are added to the
    machine (Radia software distribution uses Dist groups to assign software).
    A check showed no groups with long legacy Kerberos keys.
    When we make a change to AD Security Group membership, to assign or deny a Group Policy, is usually when we encounter this problem.  It will usually fix itself in 24 hours of the machine being left up and running.  But no amount of GPUPDATE /FORCE
    and rebooting will cause the changes to take affect.
    During this time, the Group Policies will show assigned to the computer in the GPRESULT log.
    Yesterday I began looking into Spanning Tree configuration on our network being a possible cause for the boot up issues.  I'm waiting on responses from our Network group to confirm our configuration.
    There's no place like 127.0.0.1

  • "This program is blocked by group policy"

    Hi all.
    I have searched Google a fair bit on this but shockingly I just can't find an actual answer.  The Group Policy forum is where I should have started rather than finally come to :)
    I am no genius with GP, I use it in the most basic ways in very small orgs.  My users appear to all have the same problem, when they insert a removable media device that has software on it that might run or autorun, I get the "This program
    is blocked by group policy, contact your admin" message.  I don't believe this ccurs with removable media just as just plain USB storage sticks.  So far the two examples I know of are for an Internet providers USB broadband mobility stick, and
    another user that is using some Kodak products (SD card, camera, and even the Kodak CD I think). 
    Environment is 2008 R2, Win7 Pro workstations, all users are local admin on their machine.  All users are in the default Users container, and all computers are in the Computer container.  To my recollection I have never set a GPO that would directly
    or indirectly cause all users problems like this.  The only thing that has had indirect consequences that I know of in the past, was because we use many of the options available under Folder Redirection, including redirecting the Desktop.  In some
    cases, when a user has tried to launch an exe or what not that was on the desktop, it failed because it's trying to launch in truth on their user folder on the server, not really on the Windows Desktop.  I'm not sure if that might impact my current problem. 
    To start, where can I go to actually check GPO's for this?  Is this the Software Restriction Policy?  If so, which one governs, the one in User Configuration or Copmputer Configuration?  In both cases I went to GPMC and under both, it would
    say I had to go to the Actions menu to create a New Software Restriction policy.  I did so (just picking the item in the Actions menu), and the resutlt was some choices under the actual GPO now, none of which I've yet configured. 
    So, I need to torublesahoot this ut also to know where such a thing causing this error message would be set under normal circumstances.  Also, could antivirus cause this?  I can't see the error saying "group policy" if it did though. 
    Thank you very much. 

    Hi,
    Thanks for posting your issue in the forum.
    Based on your description, I suspect that maybe Software Restriction Policy has been configured in the domain. At this time, I suggest we could try to collect the following information to narrow
    down the cause of the issue.
    GPMC.log
    ==================
    a. On domain controller, click Start ->Run, type GPMC.MSC, it will load the GPMC console.
    b. Right click on "Group Policy Result" and choose wizard to generate a report for the problematic computer and user account (please place appropriately). (Choose computer and select the proper
    user in the wizard)
    c. Right click 
    the resulting group policy result and click the "Save Report…" => save report to save the report to a HTML file.
    Once we get the report, please check if the Software Restriction Policy has been configured and applied to the problematic computers and users. If so, please disable the policy setting to see
    if the issue persists.
    In addition, please try to refer to the following articles for detailed information about Software Restriction Policy and how to troubleshoot Group Policy problems.
    Software Restriction Policies
    http://technet.microsoft.com/en-us/library/hh831534.aspx
    Troubleshooting Group Policy Problems
    http://technet.microsoft.com/en-us/library/cc787386(v=ws.10).aspx
    Hope this helps.
    Best Regards,
    Andy Qi
    TechNet Subscriber Support
    If you are
    TechNet Subscription user and have any feedback
    on our support quality, please send your feedback here.
    Andy Qi
    TechNet Community Support

  • Windows 2008 R2 group policy not applied on some of the computers

    Dear All,
    I have windows 2008 r2 as domain controller and configured group policy. when I am changing existing group policy most of the computers not affecting with update policy.
    is there any server or any other method required to configure?
    every time i need to update group policy manually on computers.
    pls help
    SUNIL PATEL SYSTEM ADMINISTRATOR

    You have an issue with AD DS replication.Ensure all domain controllers are in sync

Maybe you are looking for