Windows 7 DNS and Group Policy Issues

Hi,
We have several suites of Windows 7 domain connected PC's.
In one of the suites I have been called into look at 3 different PC's where the users have not got mapped drives, desktop backgrounds, internet connectivity - because their group policies have not applied.
When I look at the error logs I find DNS 1014 errors, and Group Policy 1054 errors.
I have looked at the logs on the switches, and there is nothing on them - Could a pupil pulling the network cable out cause these errors?... Possibly they could have put it back in before I got back in the room.
The user logs off of the PC and back on again and are fine, as are the users that logon after them.
We have 2 DC's/DNS servers, which I would have thought would be able to cope with the load here.
Please let me know what you think the likely cause could be.

Hello John555444,
What is your current situation?
Is this issue resolved?
Best regards,
Fangzhou CHEN
Fangzhou CHEN
TechNet Community Support

Similar Messages

RDS 2012 R2 - How do I lockdown access to Local Computer Management and Windows Backup via Group Policy

Greetings all,
I am needing assistance in how to lockdown access to Local Computer Management and Windows Backup via Group Policy for users that access RDS service. I have followed this awesome guide - h t t p://w w w.it.ltsoy.com/windows/lock-down-remote-desktop-services-server-2012/
- but it is missing two important resources that I would like to lock down.Currently, I have successfully locked down Control Panel for users via Group Policy, but I cannot find any group policy or guide on how to restrict user access
to Computer Management (different to Server Manager). When using Win-X shortcut to open the 'Administrator's shortcuts' near the windows icon, I have locked down everything except Computer Management. Computer Management gives direct access to Disk Management,
Shares etc, which are locked down for users. But Windows Server Backup is still accessible. Can someone please guide me on how to restrict access to both Computer Management and Windows Server Backup.
Thanks in advance.
Terry.

Prevent running of Windows Server Backup
Computer Configuration\Policies\Windows Settings\Security Settings\File System
Right click on File System - Add File - Drill down to \System32\wbadmin.msc
On the Database Security ACL that pops up - Remove Creator Owner, Remove Users and check Adminstrators have Full Access.
On the Object window - choose Propagate inheritable permissions to all... (Default)

File and Printer sharing on Windows 7 Through Group Policy

Hi,
I was wondering how to enable File and Printer sharing on Windows 7 Through Group Policy. I have enabled the policy called: Allow inbound file and printer sharing exception.
But when I go to advanced sharing settings, it's still turned off.
Windows Server 2003 AD Domain, and I'm using the Group Policy Manager from my Windows 7 machine to edit the policy.
Any ideas?

Hi,
Based on my knowledge, there is no Group Policy setting for enabling and disabling File and Printer sharing. To do this, you may need to write a script and you can go to our Scripting Forum for help.
In addition, I would like to share the following with you:
Enable or Disable File Sharing for a User or Group by Using Group Policy
Network and Sharing Center Group Policy Settings
Hope this helps. Thanks.
Nicholas Li - MSFT

Windows Active directory group policy objects

Like many small to medium businesses, we use Firefox in addition to Internet Explorer. The Windows Active Directory group policy objects we have for IE works nicely in all versions of IE. Firefox on the other hand has stopped playing ball. Any policy files I have found on the Internet simply does not fire when used in Windows Group Policy. We have Windows 2008 R2 servers with Windows 7 clients.
Does Mozilla have official group policy objects that will work with Windows Active Directory group policy and is supported in Firefox versions 27 onwards? A lot of the material on the Internet are simply workarounds to achieve something simple.
I believe this may have been asked several times already, but no definitive answer has been supplied to
resolve the issue to my knowledge.
Thanks and regards

To my knowledge, Firefox historically has not had integration with group policy, and third party tools have been required to bridge the gap. You may have found templates that work in one of those tools.
These threads have links to third party tools, articles, mailing lists, and other resources:
* [https://support.mozilla.org/questions/980567 i need to include the Firefox Browser Configuration in my Group Policy and Control Proxy and Browsing Settings]
* [https://support.mozilla.org/questions/978874 Is it possible to configure firefox using group policy]
Please report back if you find a solution. Thanks.

Disabling windows update via group policy

hi,
i would like to disable automatic windows upate via group policy on windows server 2008. is it possible?
thanks.
sundeep

hi,
disabling the automatic update is not a recommended practice, but here are the steps,
Click Start, and then click
Run.
Type gpedit.msc, and then click
OK.
Expand Computer Configuration.
Right-click Administrative Templates, and then click
Add/Remove Templates.
Click Add, click
Wuau.admin the Windows\Inf folder, and then click Open.
Click Close.
Under Computer Configuration, expand
Administrative Templates, expand Windows Components, and then expand Windows Update.
The Configure Automatic Updatespolicy appears. This policy specifies whether the computer receives security updates and other important downloads through the Windows Automatic Updates feature. The settings for this policy let you specify if
automatic updates are enabled on the computer. If the service is enabled, you must select one of the three configuration options.
To view the policy settings, double-click the
Configure Automatic Updatespolicy.
To turn on Automatic Updates, click
Enabled or to turn off select
Disabled
hope this helps
thanks

How to create windows users and groups from Java

Hi,
Can any one please tell me, which Package/API will helps to create windows users and groups from Java.
Thanks,
M.Prem.

You can't do it with pure Java, and it's not in the core API. You'd have to write a native function to do it, using whatever API Windows provides, and then call it with JNI. Or look for a third party native-based Java library that already does that.

Windows 2008 R2 group policy not applied to windows 8 Workstations, but applied to XP and Win 7

I have a Windows 2008 R2 Domain Controllers and have a Policy to put a specify wallpaper, eventuality i have to change the Wallpaper, this setting applied sucesfully in Windows xp and Windows 7 workstations, but not applied in Windows 8 workstations even
if i run gpupdate /forcé,
Best Regards,
Thank you

Hi,
Thanks for posting in the forum.
Before going further, would you please let me know how did you configure the Group Policy setting to deploy the wallpaper? Have you configured some settings to limit the scope the GPO applying?
If all Windows 8 machines failed to receive the GPO settings? In order to narrow down the cause of the issue, I suggest we could try to collect the following information for troubleshooting.
GPMC.log
==================
a. On domain controller, click Start ->Run, type GPMC.MSC, it will load the GPMC console.
b. Right click on "Group Policy Result" and choose wizard to generate a report for the problematic computer and user account (please place appropriately). (Choose computer and select the proper
user in the wizard)
c. Right click
the resulting group policy result and click the "Save Report…" => save report to save the report to a HTML file.
Once we get the report, please check if the settings have been applied to the target correctly.
In addition, would you please let me know whether you have imported the latest Windows 8 Administrative Templates to the Windows Server 2008 DC? If not, please try to download and import it.
Then try to configure the wallpaper GPO settings again to see if it could help.
For details, please refer to the following articles.
Administrative Templates (.admx) for Windows 8 and Windows Server 2012
http://www.microsoft.com/en-us/download/details.aspx?id=36991
Set Desktop Background via Group Policy in Windows 7, Windows 8 in a Server 2008 or Server 2012 Domain
http://dizzyit.com/2013/04/14/set-desktop-background-group-policy-windows-7-windows-8-server-2008-server-2012-domain/
Hope this helps.
Best Regards,
Andy Qi
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback on our support quality, please send your feedback
here.
Andy Qi
TechNet Community Support

How do I setup Active Directory and Group Policy on Windows Server 2012?

I work for a school district that uses a Windows 2012 server with about 400 Windows 7 PCs and 150 Mac PCs. We are set up with Roaming Profiles on the PCs and would like to be able to setup Active Directory, Group Policy, and Roaming Profiles on our macs. (We also have a mac server that they are using as a file server only) As we are a school, our funds are very low. Now for the questions...
Is there a software that allow us to accomplish this?
Is there a free solution or a very reduced price option to do this?
I heard that http://www.centrify.com/products/mac-edition.asp may accomplish this and I read something about it on here but didn't know if this is what I was really trying to do becuase it was marked as "The Golden Triangle" and did not mention Raoming Profiles. This is the link though: https://discussions.apple.com/message/17200059#17200059
Any help would be greatly appreciated.

The above reply does not take into account that I am trying to use GROUP POLICY EDITOR to make it the default browser.

Group policy issue

I have two Domain Controllers Main ( Main DC ) and Second DC.
the date of some policies is not out of date....
please check these files to know the problem.
dcdiag.txt output:
Directory Server Diagnosis
Performing initial setup:
   Trying to find home server...
   * Verifying that the local machine ASMDC, is a Directory Server.
   Home Server = ASMDC
   * Connecting to directory service on server ASMDC.
   * Identified AD Forest.
   Collecting AD specific global data
   * Collecting site info.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=buc,DC=edu,LDAP_SCOPE_SUBTREE,(objectCategory=ntDSSiteSettings),.......
   The previous call succeeded
   Iterating through the sites
   Looking at base site object: CN=NTDS Site Settings,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
   Getting ISTG and options for the site
   * Identifying all servers.
   Calling ldap_search_init_page(hld,CN=Sites,CN=Configuration,DC=buc,DC=edu,LDAP_SCOPE_SUBTREE,(objectClass=ntDSDsa),.......
   The previous call succeeded....
   The previous call succeeded
   Iterating through the list of servers
   Getting information for the server CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
   objectGuid obtained
   InvocationID obtained
   dnsHostname obtained
   site info obtained
   All the info for the server collected
   Getting information for the server CN=NTDS Settings,CN=BSMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
   objectGuid obtained
   InvocationID obtained
   dnsHostname obtained
   site info obtained
   All the info for the server collected
   * Identifying all NC cross-refs.
   * Found 2 DC(s). Testing 2 of them.
   Done gathering initial info.
Doing initial required tests
   Testing server: Default-First-Site-Name\ASMDC
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         Determining IP4 connectivity
         Determining IP6 connectivity
         * Active Directory RPC Services Check
         ......................... ASMDC passed test Connectivity
   Testing server: Default-First-Site-Name\BSMDC
      Starting test: Connectivity
         * Active Directory LDAP Services Check
         Determining IP4 connectivity
         Determining IP6 connectivity
         * Active Directory RPC Services Check
         ......................... BSMDC passed test Connectivity
Doing primary tests
   Testing server: Default-First-Site-Name\ASMDC
      Starting test: Advertising
         The DC ASMDC is advertising itself as a DC and having a DS.
         The DC ASMDC is advertising as an LDAP server
         The DC ASMDC is advertising as having a writeable directory
         The DC ASMDC is advertising as a Key Distribution Center
         The DC ASMDC is advertising as a time server
         The DS ASMDC is advertising as a GC.
         ......................... ASMDC passed test Advertising
      Test omitted by user request: CheckSecurityError
      Test omitted by user request: CutoffServers
      Starting test: FrsEvent
         * The File Replication Service Event log test
         ......................... ASMDC passed test FrsEvent
      Starting test: DFSREvent
         The DFS Replication Event Log.
         ......................... ASMDC passed test DFSREvent
      Starting test: SysVolCheck
         * The File Replication Service SYSVOL ready test
         File Replication Service's SYSVOL is ready
         ......................... ASMDC passed test SysVolCheck
      Starting test: KccEvent
         * The KCC Event log test
         Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
         ......................... ASMDC passed test KccEvent
      Starting test: KnowsOfRoleHolders
         Role Schema Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Domain Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role PDC Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Rid Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Infrastructure Update Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         ......................... ASMDC passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         Checking machine account for DC ASMDC on DC ASMDC.
         * SPN found :LDAP/ASMDC.buc.edu/buc.edu
         * SPN found :LDAP/ASMDC.buc.edu
         * SPN found :LDAP/ASMDC
         * SPN found :LDAP/ASMDC.buc.edu/BUC
         * SPN found :LDAP/5e88f85b-15a6-4ff5-b0fd-6df748df06fd._msdcs.buc.edu
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/5e88f85b-15a6-4ff5-b0fd-6df748df06fd/buc.edu
         * SPN found :HOST/ASMDC.buc.edu/buc.edu
         * SPN found :HOST/ASMDC.buc.edu
         * SPN found :HOST/ASMDC
         * SPN found :HOST/ASMDC.buc.edu/BUC
         * SPN found :GC/ASMDC.buc.edu/buc.edu
         ......................... ASMDC passed test MachineAccount
      Starting test: NCSecDesc
         * Security Permissions check for all NC's on DC ASMDC.
         * Security Permissions Check for
           DC=ForestDnsZones,DC=buc,DC=edu
            (NDNC,Version 3)
         * Security Permissions Check for
           DC=DomainDnsZones,DC=buc,DC=edu
            (NDNC,Version 3)
         * Security Permissions Check for
           CN=Schema,CN=Configuration,DC=buc,DC=edu
            (Schema,Version 3)
         * Security Permissions Check for
           CN=Configuration,DC=buc,DC=edu
            (Configuration,Version 3)
         * Security Permissions Check for
           DC=buc,DC=edu
            (Domain,Version 3)
         ......................... ASMDC passed test NCSecDesc
      Starting test: NetLogons
         * Network Logons Privileges Check
         Verified share \\ASMDC\netlogon
         Verified share \\ASMDC\sysvol
         ......................... ASMDC passed test NetLogons
      Starting test: ObjectsReplicated
         ASMDC is in domain DC=buc,DC=edu
         Checking for CN=ASMDC,OU=Domain Controllers,DC=buc,DC=edu in domain DC=buc,DC=edu on 2 servers
            Object is up-to-date on all servers.
         Checking for CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu in domain CN=Configuration,DC=buc,DC=edu on 2 servers
            Object is up-to-date on all servers.
         ......................... ASMDC passed test ObjectsReplicated
      Test omitted by user request: OutboundSecureChannels
      Starting test: Replications
         * Replications Check
         * Replication Latency Check
            DC=ForestDnsZones,DC=buc,DC=edu
               Latency information for 1 entries in the vector were ignored.
                  1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            DC=DomainDnsZones,DC=buc,DC=edu
               Latency information for 1 entries in the vector were ignored.
                  1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            CN=Schema,CN=Configuration,DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            CN=Configuration,DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
         * Replication Site Latency Check
         ......................... ASMDC passed test Replications
      Starting test: RidManager
         * Available RID Pool for the Domain is 8604 to 1073741823
         * ASMDC.buc.edu is the RID Master
         * DsBind with RID Master was successful
         * rIDAllocationPool is 7604 to 8103
         * rIDPreviousAllocationPool is 7604 to 8103
         * rIDNextRID: 7640
         ......................... ASMDC passed test RidManager
      Starting test: Services
         * Checking Service: EventSystem
         * Checking Service: RpcSs
         * Checking Service: NTDS
         * Checking Service: DnsCache
         * Checking Service: NtFrs
         * Checking Service: IsmServ
         * Checking Service: kdc
         * Checking Service: SamSs
         * Checking Service: LanmanServer
         * Checking Service: LanmanWorkstation
         * Checking Service: w32time
         * Checking Service: NETLOGON
         ......................... ASMDC passed test Services
      Starting test: SystemLog
         * The System Event log test
         An Warning Event occurred. EventID: 0x825A0024
            Time Generated: 08/21/2014   00:22:16
            Event String:
            The time service has not synchronized the system time for 86400 seconds because none of the time service providers provided a usable time stamp. The time service will not update the local system
time until it is able to synchronize with a time source. If the local system is configured to act as a time server for clients, it will stop advertising as a time source to clients. The time service will continue to retry and sync time with its time sources.
Check system event log for other W32time events for more details. Run 'w32tm /resync' to force an instant time synchronization.
         An Warning Event occurred. EventID: 0x8000000E
            Time Generated: 08/21/2014   00:32:29
            Event String:
            There were password errors using the Credential Manager. To remedy, launch the Stored User Names and Passwords control panel applet, and reenter the password for the credential BUC.EDU\administrator.
         An Error Event occurred. EventID: 0x00000422
            Time Generated: 08/21/2014   00:32:29
            Event String:
            The processing of Group Policy failed. Windows attempted to read the file \\buc.edu\sysvol\buc.edu\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini from a domain controller and was not
successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
            a) Name Resolution/Network Connectivity to the current domain controller.
            b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
            c) The Distributed File System (DFS) client has been disabled.
         ......................... ASMDC failed test SystemLog
      Test omitted by user request: Topology
      Test omitted by user request: VerifyEnterpriseReferences
      Starting test: VerifyReferences
         The system object reference (serverReference)
         CN=ASMDC,OU=Domain Controllers,DC=buc,DC=edu and backlink on
         CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         are correct.
         The system object reference (serverReferenceBL)
         CN=ASMDC,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=buc,DC=edu
         and backlink on
         CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         are correct.
         ......................... ASMDC passed test VerifyReferences
      Test omitted by user request: VerifyReplicas
   Testing server: Default-First-Site-Name\BSMDC
      Starting test: Advertising
         The DC BSMDC is advertising itself as a DC and having a DS.
         The DC BSMDC is advertising as an LDAP server
         The DC BSMDC is advertising as having a writeable directory
         The DC BSMDC is advertising as a Key Distribution Center
         The DC BSMDC is advertising as a time server
         The DS BSMDC is advertising as a GC.
         ......................... BSMDC passed test Advertising
      Test omitted by user request: CheckSecurityError
      Test omitted by user request: CutoffServers
      Starting test: FrsEvent
         * The File Replication Service Event log test
         ......................... BSMDC passed test FrsEvent
      Starting test: DFSREvent
         The DFS Replication Event Log.
         ......................... BSMDC passed test DFSREvent
      Starting test: SysVolCheck
         * The File Replication Service SYSVOL ready test
         File Replication Service's SYSVOL is ready
         ......................... BSMDC passed test SysVolCheck
      Starting test: KccEvent
         * The KCC Event log test
         Found no KCC errors in "Directory Service" Event log in the last 15 minutes.
         ......................... BSMDC passed test KccEvent
      Starting test: KnowsOfRoleHolders
         Role Schema Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Domain Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role PDC Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Rid Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         Role Infrastructure Update Owner = CN=NTDS Settings,CN=ASMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         ......................... BSMDC passed test KnowsOfRoleHolders
      Starting test: MachineAccount
         Checking machine account for DC BSMDC on DC BSMDC.
         * SPN found :LDAP/BSMDC.buc.edu/buc.edu
         * SPN found :LDAP/BSMDC.buc.edu
         * SPN found :LDAP/BSMDC
         * SPN found :LDAP/BSMDC.buc.edu/BUC
         * SPN found :LDAP/93561cab-4fb3-421f-9a67-af6b4c280eca._msdcs.buc.edu
         * SPN found :E3514235-4B06-11D1-AB04-00C04FC2DCD2/93561cab-4fb3-421f-9a67-af6b4c280eca/buc.edu
         * SPN found :HOST/BSMDC.buc.edu/buc.edu
         * SPN found :HOST/BSMDC.buc.edu
         * SPN found :HOST/BSMDC
         * SPN found :HOST/BSMDC.buc.edu/BUC
         * SPN found :GC/BSMDC.buc.edu/buc.edu
         ......................... BSMDC passed test MachineAccount
      Starting test: NCSecDesc
         * Security Permissions check for all NC's on DC BSMDC.
         * Security Permissions Check for
           DC=ForestDnsZones,DC=buc,DC=edu
            (NDNC,Version 3)
         * Security Permissions Check for
           DC=DomainDnsZones,DC=buc,DC=edu
            (NDNC,Version 3)
         * Security Permissions Check for
           CN=Schema,CN=Configuration,DC=buc,DC=edu
            (Schema,Version 3)
         * Security Permissions Check for
           CN=Configuration,DC=buc,DC=edu
            (Configuration,Version 3)
         * Security Permissions Check for
           DC=buc,DC=edu
            (Domain,Version 3)
         ......................... BSMDC passed test NCSecDesc
      Starting test: NetLogons
         * Network Logons Privileges Check
         Verified share \\BSMDC\netlogon
         Verified share \\BSMDC\sysvol
         ......................... BSMDC passed test NetLogons
      Starting test: ObjectsReplicated
         BSMDC is in domain DC=buc,DC=edu
         Checking for CN=BSMDC,OU=Domain Controllers,DC=buc,DC=edu in domain DC=buc,DC=edu on 2 servers
            Object is up-to-date on all servers.
         Checking for CN=NTDS Settings,CN=BSMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu in domain CN=Configuration,DC=buc,DC=edu on 2 servers
            Object is up-to-date on all servers.
         ......................... BSMDC passed test ObjectsReplicated
      Test omitted by user request: OutboundSecureChannels
      Starting test: Replications
         * Replications Check
         * Replication Latency Check
            DC=ForestDnsZones,DC=buc,DC=edu
               Latency information for 1 entries in the vector were ignored.
                  1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            DC=DomainDnsZones,DC=buc,DC=edu
               Latency information for 1 entries in the vector were ignored.
                  1 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            CN=Schema,CN=Configuration,DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            CN=Configuration,DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
            DC=buc,DC=edu
               Latency information for 5 entries in the vector were ignored.
                  5 were retired Invocations. 0 were either: read-only replicas and are not verifiably latent, or dc's no longer replicating this nc. 0 had no latency
information (Win2K DC).
         * Replication Site Latency Check
         ......................... BSMDC passed test Replications
      Starting test: RidManager
         * Available RID Pool for the Domain is 8604 to 1073741823
         * ASMDC.buc.edu is the RID Master
         * DsBind with RID Master was successful
         * rIDAllocationPool is 8104 to 8603
         * rIDPreviousAllocationPool is 8104 to 8603
         * rIDNextRID: 8106
         ......................... BSMDC passed test RidManager
      Starting test: Services
         * Checking Service: EventSystem
         * Checking Service: RpcSs
         * Checking Service: NTDS
         * Checking Service: DnsCache
         * Checking Service: NtFrs
         * Checking Service: IsmServ
         * Checking Service: kdc
         * Checking Service: SamSs
         * Checking Service: LanmanServer
         * Checking Service: LanmanWorkstation
         * Checking Service: w32time
         * Checking Service: NETLOGON
         ......................... BSMDC passed test Services
      Starting test: SystemLog
         * The System Event log test
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:15
            Event String:
            Driver Send To Microsoft OneNote Driver required for printer Send To OneNote 2007 is unknown. Contact the administrator to install the driver before you log in again.
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:18
            Event String:
            Driver SolidPDF XChange required for printer SolidPDF XChange is unknown. Contact the administrator to install the driver before you log in again.
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:18
            Event String:
            Driver NRG SP 3400N PCL 6 required for printer !!net_pc5!NRG SP 3400N PCL 6 is unknown. Contact the administrator to install the driver before you log in again.
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:19
            Event String:
            Driver Send To Microsoft OneNote Driver required for printer !!BUCLAPTOP1!Send To OneNote 2007 is unknown. Contact the administrator to install the driver before you log in again.
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:20
            Event String:
            Driver NRG SP 3400N PCL 6 required for printer !!BUCLAPTOP1!NRG SP 3400N PCL 6 is unknown. Contact the administrator to install the driver before you log in again.
         An Warning Event occurred. EventID: 0x80000008
            Time Generated: 08/20/2014   23:52:20
            Event String:
            The jobs in the print queue for printer Microsoft XPS Document Writer (redirected 2) were deleted. No user action is required.
            To stop logging warning events for the print spooler, in Control Panel, open Printers, right-click a blank area of the window, click Run as Administrator, click Server Properties, click the
Advanced tab, and then clear the Log spooler warning events check box.
         An Warning Event occurred. EventID: 0x80000004
            Time Generated: 08/20/2014   23:52:20
            Event String:
            Printer Microsoft XPS Document Writer (redirected 2) will be deleted. No user action is required.
            To stop logging warning events for the print spooler, in Control Panel, open Printers, right-click a blank area of the window, click Run as Administrator, click Server Properties, click the
Advanced tab, and then clear the Log spooler warning events check box.
         An Warning Event occurred. EventID: 0x80000003
            Time Generated: 08/20/2014   23:52:20
            Event String:
            Printer Microsoft XPS Document Writer (redirected 2) was deleted, and users will no longer be able to print to this printer. No user action is required.
            To stop logging information events for the print spooler, in Control Panel, open Printers, right-click a blank area of the window, click Run as Administrator, click Server Properties, click
the Advanced tab, and then clear the Log spooler information events check box.
         An Error Event occurred. EventID: 0x00000457
            Time Generated: 08/20/2014   23:52:22
            Event String:
            Driver NRG SP 3400N PCL 6 required for printer !!BUCLAPTOP1!NRG SP 3400N PCL 6 (Copy 1) is unknown. Contact the administrator to install the driver before you log in again.
         ......................... BSMDC failed test SystemLog
      Test omitted by user request: Topology
      Test omitted by user request: VerifyEnterpriseReferences
      Starting test: VerifyReferences
         The system object reference (serverReference)
         CN=BSMDC,OU=Domain Controllers,DC=buc,DC=edu and backlink on
         CN=BSMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         are correct.
         The system object reference (serverReferenceBL)
         CN=BSMDC,CN=Domain System Volume (SYSVOL share),CN=File Replication Service,CN=System,DC=buc,DC=edu
         and backlink on
         CN=NTDS Settings,CN=BSMDC,CN=Servers,CN=Default-First-Site-Name,CN=Sites,CN=Configuration,DC=buc,DC=edu
         are correct.
         ......................... BSMDC passed test VerifyReferences
      Test omitted by user request: VerifyReplicas
      Test omitted by user request: DNS
      Test omitted by user request: DNS
      Test omitted by user request: DNS
      Test omitted by user request: DNS
   Running partition tests on : ForestDnsZones
      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test
         CrossRefValidation
   Running partition tests on : DomainDnsZones
      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test
         CrossRefValidation
   Running partition tests on : Schema
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
   Running partition tests on : Configuration
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
   Running partition tests on : buc
      Starting test: CheckSDRefDom
         ......................... buc passed test CheckSDRefDom
      Starting test: CrossRefValidation
         ......................... buc passed test CrossRefValidation
   Running enterprise tests on : buc.edu
      Test omitted by user request: DNS
      Test omitted by user request: DNS
      Starting test: LocatorCheck
         GC Name: \\ASMDC.buc.edu
         Locator Flags: 0xe00013fd
         PDC Name: \\ASMDC.buc.edu
         Locator Flags: 0xe00013fd
         Time Server Name: \\ASMDC.buc.edu
         Locator Flags: 0xe00013fd
         Preferred Time Server Name: \\ASMDC.buc.edu
         Locator Flags: 0xe00013fd
         KDC Name: \\ASMDC.buc.edu
         Locator Flags: 0xe00013fd
         ......................... buc.edu passed test LocatorCheck
      Starting test: Intersite
         Skipping site Default-First-Site-Name, this site is outside the scope
         provided by the command line arguments provided.
         ......................... buc.edu passed test Intersite
====================================================================
Repadmin: running command /showrepl against full DC localhost
Default-First-Site-Name\ASMDC
DSA Options: IS_GC
Site Options: (none)
DSA object GUID: 5e88f85b-15a6-4ff5-b0fd-6df748df06fd
DSA invocationID: 1355f657-cd24-4ad4-b890-f04f5c624acd
==== INBOUND NEIGHBORS ======================================
DC=buc,DC=edu
    Default-First-Site-Name\BSMDC via RPC
        DSA object GUID: 93561cab-4fb3-421f-9a67-af6b4c280eca
        Last attempt @ 2014-08-21 00:43:56 was successful.
CN=Configuration,DC=buc,DC=edu
    Default-First-Site-Name\BSMDC via RPC
        DSA object GUID: 93561cab-4fb3-421f-9a67-af6b4c280eca
        Last attempt @ 2014-08-21 00:41:11 was successful.
CN=Schema,CN=Configuration,DC=buc,DC=edu
    Default-First-Site-Name\BSMDC via RPC
        DSA object GUID: 93561cab-4fb3-421f-9a67-af6b4c280eca
        Last attempt @ 2014-08-20 23:51:37 was successful.
DC=DomainDnsZones,DC=buc,DC=edu
    Default-First-Site-Name\BSMDC via RPC
        DSA object GUID: 93561cab-4fb3-421f-9a67-af6b4c280eca
        Last attempt @ 2014-08-21 00:45:39 was successful.
DC=ForestDnsZones,DC=buc,DC=edu
    Default-First-Site-Name\BSMDC via RPC
        DSA object GUID: 93561cab-4fb3-421f-9a67-af6b4c280eca
        Last attempt @ 2014-08-20 23:51:37 was successful.
Regards and thanks in advance
Mhiar

Hi,
Based on the description, the Sysvol is replicated by FRS service.
>>some policies at the main DC are not updated like same policies in second DC.
In this case, we can do a non-authoritative restore on the main DC.
To do so:
Click Start, and then click
Run.
In the
Open box, type cmd and then press ENTER.
In the
Command box, type net stop ntfrs.
Click Start, and then click
Run.
In the
Open box, type regedit and then press ENTER.
Locate the following subkey in the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
In the right pane, double-click
BurFlags.
In the
Edit DWORD Value dialog box, type D2 and then click OK.
Quit Registry Editor, and then switch to the
Command box.
In the
Command box, type net start ntfrs.
Quit the
Command box.
Regarding reinitializing File Replication Service replica sets, the following article can be referred to for more information.
Using the BurFlags registry key to reinitialize File Replication Service replica sets
http://support.microsoft.com/kb/290762/en-us
Best regards,
Frank Shen

Uninstall a windows update usign group policy

Hi !
Recently I installed Service Pack 1 for windows server 2008 R2 and after that i lost RDP to it.
Investigated it and found a security update is the cause.
I connected using iLo and uninstalled it and all went ok
so here is what i want
is there anyway to uninstall a windows update from different clients using group policy or WSUS ?

Hi,
On Group Policy Management Console, Go to GPO that will contain the script and go to Computer Configuration > Policies > Windows Settings > Scripts (Start up/Shutdown)
Click Add and then Browse. This will open the GPO in the Sysvol share for you to create the batch file.Add Shutdown
script
use Shutdown scripts when you need to remove an update which creates issue.
Note: updates may require a reboot after removal. By using a Shutdown script, the script can run at the next system shutdown/reboot event and the update removal process gets the reboot it needs.
By using a Startup script, you may end up needing two reboots to remove the update: one reboot so that the script runs at the next system start and a possible second reboot if the update removal process requires it.
Use the below script by replacing the you own KB that needs to be kicked from servers.
Make below .bat
C:\Windows\System32\wusa.exe/uninstall/kb:example12345555/quiet/norestart/log
By adding the optional, /log, you can go into the Setup Event Log and check that your update was removed.
Event Log- Windows update was successfully uninstalled
Regards
Raj
ADS/DNS/DHCP/RIS/GROUP POLICY/PowerShell/VMware/Esxi/Storage.

Windows 8.1 Group Policy based Wireless Profiles do not appear to be working

I'm wondering if anyone else out there has run into the same issue as I am seeing. The environment is all Server 2012(not R2), with Windows 8.1 clients.
I configure a GPO that is linked to the entire domain/authenticated users and contains a Windows Vista and Later wireless network profile. Let's call it "GPO_Wireless. It is configured to automatically connect it to a specific SSID, the
encryption settings are unimportant, as I've tried numerous approaches. In our case, we're trying to do EAP-TLS with the NPS role. We have the CA rolled out, NPS has a proper cert, and the clients are auto-enrolling for both Computer and User certs.
This is all verified as working. We've also tried straight password authentication.
I refresh group policy on a Windows 8.1 client and see that Computer Policy "GPO_Wireless" is being applied to the client. I restart the computer, but it does not connect to the wireless network.
I run "netsh wlan show profiles" and under "Group Policy Profiles(read only)" it is blank.
I run gpresult /r /scope computer again, and it shows "GPO_Wireless" is being applied.
The last note is that Windows 7 clients can connect to the wireless just fine.

Hi，
For the client side, I would like to know if the windows 7 as you mentioned used the same Group Police like Windows 8.1.
Meanwhile, I suggest you try using script as a workaround.
Regards,
Kelvin hsu
TechNet Community Support

Group Policy - Issues deploying software packages through GPO

Hello everyone,
I am having issues successfully deploying MSI packages through group policy. I have set my computer account up in its own test OU in my domain, but yet the software will not deploy. Example, I'm trying to deploy AVG Anti-Virus and make sure it
is installed on each and every PC in my domain. As for the GPO, I set it up as an assigned package and pointed to the location of the package with the UNC file path (visible to both the DC and my computer that is part of the affected OU)
On the domain controller, I get these messages in application event logs:
Beginning a Windows Installer transaction: \\hs-dc2\software\avg\installavg.msi. Client Process Id: 9048.
Ending a Windows Installer transaction: \\hs-dc2\software\avg\installavg.msi. Client Process Id: 9048.
This shows up when I refresh GP on my computer. I run gpresult /h GPReport.html and get the following message:
Software Installation failed due to the error listed below.
Fatal error during installation.
Additional information may have been logged. Review the Policy Events tab in the console or the application event log for events between
The software is in a share on the domain controller that is visible from my computer, and permissions are set where "Everyone" has read access. I have tested the package on my computer and it installs
correctly if I do it manually, so it's a good package.
I'm at a loss. I am admitedly very new to GP management, but I'm pretty sure I have covered all my bases here. I humbly ask for any and all help that you all can provide.
Thank you all very much, have a great weekend!

> Magnolia_Schools.exe
What's that???
> \\hs-dc2\software\avg\installavg.msi
> <file://\\hs-dc2\software\avg\installavg.msi> /qb addeploy=1
/qb ADDEPLOY=1
Uppercase matters (:
A bissle "Experience", a bissle GMV... Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
I should have explained, my apologies. The InstallAVG.msi is the package I have GP deploying. it is a package that AVG wrote for us that goes in, uninstalls the two previous antivirus softwares we have on our network if it is present, and
then wraps it to run magnolia_schools.exe which installs the AV software. I am uninstalling AVG now and will try reinstalling with
\\hs-dc2\software\avg\installavg.msi /qb ADDEPLOY=1 and report back.
also, the only logs I found that were around the time of the install attempt were such as these:
1: 2905 2: C:\windows\system32\appmgmt\MACHINE\{06ee0d46-cd5f-4216-a09f-2aeb573aa5ba}.aas
1: 2905 2: C:\windows\system32\appmgmt\MACHINE\{06ee0d46-cd5f-4216-a09f-2aeb573aa5ba}.aas
Does that tell you anything?
I will say this, if this means anything...now that AVG is installed, the event logs are changing from an error %%1603 to this:
Failed to apply changes to software installation settings. The installation of software deployed through Group Policy for this user has been delayed until the next logon because the changes must be applied before the user logon. The error was : %%1274
The removal of the assignment of application exe2msiSetupPackage from policy Install AVG failed. The error was : %%2
So it acts like it's at least seeing that the package is installed...and reacting differently, correct?
Thanks so much

Windows Server 2012 Group Policy Block USB Storage devices @ User Level Not getting applied on a Domain Client machine with Windows Server 2008 R2. Why?

Hello,
I have a Windows Server 2012 R2.
I have configured the Group Policy on it to block the usage of USB - Storage Devices @ user level on the client machines. It works properly for my Windows 7 client machines but it's not working on one of the machine having Windows Server 2008 R2 installed
on it (this machine is also a domain client in the same domain).
I will really be thankful if anyone can suggest some solution to this issue.
Please feel free to write back in-case I have missed anything obvious to be shared.
Thanks!
-Vinay Pugalia
If a post answers your question, please click "Mark As Answer" on that post or
"Vote as Helpful".
Web : Inkey Solutions
Blog : My Blog
Email : Vinay Pugalia

Hi,
Any update?
Just checking in to see if the suggestions were helpful. Please let us know if you would like further assistance.
Best Regards,
Andy Qi
TechNet
Subscriber Support
If you are TechNet
Subscription user and have any feedback on our support quality, please send your feedbackhere.
Andy Qi
TechNet Community Support

Urgent Group Policy Issue - not applying despite saying it does

Thank you for this urgent help. Auditors checking this out tomorrow morning.
We have a GPO that sets the eventlog audit settings for success or failure security events. The scope is set to Authenticated Users.
When I run the group policy wizard in GPMC it shows the settings applying to one of our servers in that OU.
When I run gpresult/z from that server it shows the policy applying to that server.
But when I go into gpedit.msc the security audit settings are all set to "not defined" and they are grayed out so I can't edit them manually.
As a test I set the GPO to deny applying to that server. I ran gpudpate/force on the system and then gpresult and it shows the GPO now not applying. But the settings are still set to not defined and still not editable. they are not being set by any other GPO.
In the event logs I only see three GPO errors but they are unrelated. A separate GPO is having issues creating user accounts. No other GPOs apply.
Quick help would be fantastic.
Server runs on Windows Server 2008 R2 (I can edit GPO but not the domain ones and I don't have access to the domain controllers).

OK, After several hours I figured it out. Turns out there's bugs and odd functionality.
If someone ever tested the 'advanced audit settings' (which I did in the same GPO at some point) then it sets a registry key to disable the use of the older basic audit settings. But when you stop using those advanced settings in your GPO it doesn't remove
that registry bit. So I used the GPO to undo that setting. This was the first step. This is found Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options > "Audit: Force audit policy subcategory
settings (Windows Vista or later) to override audit policy category settings" to DISABLED.
Even though this is done, sometimes the GPO files on the domain controllers don't remove the old audit settings. So in the comments of another thread I found out you may have to go to
\\domain-fqdn\SYSVOL\domain-fqdn\Policies\{your-policy-id-where-this-setting-was-originally-set}\Machine\Microsoft\Windows NT\ and delete the Audit folder which is left behind due to some odd bug. If you don't do this even after doing the next step the
next gpupdate will bring that security setting above back down.
Next you have to reset your audit settings on your PC to the defaults. Unfortunately there is no way to do this. Auditpol /clear does not accomplish this. The only way to do this is to take the audit settings from another working system, export them and
then 'restore' those same settings to the affected server. To do this:
1. On 'working system' run cmd.exe as administrator and export the audit settings to a folder like this:
auditpol /backup /file:c:\working-auditpol-settings.txt
2. Copy that file to the broken system such as the C:\ drive and run this on the broken system:
auditpol /restore /file:c:\working-auditpol-settings.txt
Open GPEDIT.MSC and verify the audit settings are back to normal. Computer Configuration > Windows Settings > Security Settings > Local Policies > Audit Policy
Then run gpupdate/force on the formerly broken system. Close gpedit.msc and reopen and verify the settings were not overwritten. If you skipped the sysvol audit folder deletion step they may come back.
Hope this helps someone.

Windows 2008 R2 - Group Policy Preference - folder option "Open with" Access denied

Similar to this post:
social.technet.microsoft.com/Forums/en-US/d42a81bc-96de-4af3-bc41-079e88e6ea4a
We have Citrix terminal servers running Windows 2008 R2 and attempting to force PDF files to open with Acrobat versus PDF editing software we have installed for a small subset of users. So I created a Group Policy Preference and added a OpenWith item
to the Folder Options to use Acrobat as the default and linked it to a Users OU. However, if I run gpresult the OpenWith setting fails with error code 0x80070005. You can change it to not run in the user's security context which eliminates the
error but then it won't actually do anything.
The problem seems to be that when a user sets another program as their default via Windows Explorer the permissions on HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice get changed so that the user is specifically
denied the ability to set that key. Remove the special permissions added and the group policy succeeds and changes it back to the default ... until the user changes it back (intentionally or otherwise) and the permissions are changed again.
Any ideas here?

> Any ideas here?
We use GPP Registry to achieve this goal, so we do not run into that
issue (we unchecked "run in users context", so privs are not an issue)
But I agree, this really should work as intended...
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Windows 7 DNS and Group Policy Issues

Similar Messages

Maybe you are looking for