Windows 2003 Group Policy Issue

Hi gals/ guys
Yet again i seek your advice and help in an issue i am facing form last few days, the Group Policy of my windows 2003 machine got corrupted or dunno what happen to it. Not a single user of the domain could logged into the machine, even can't accesss the shared folder.

Even when I try to join a system on Domain i get the same message (attached screenshot). When i try to delete the group policy i get the same message, even can't modify it. Although i am logged into the system with Administrator ID and i am administrator of the system.

how is dns working? i'm assuming that you are using a domain admin account to log on, correct?

check the event logs as well and head over to eventid.net it's a very helpful site.

Is the machine a server or a workstation?
On a server "regular" non-admin useraccounts cannot logon (locally) by default.

Is the time set correctly?

Sir Dice
Machine is a server and i am logged into the machine with Domain Admin account. Time set correctly ?

I think you have to be a server admin to adjust the group policy on a server....

Yes check the time on the workstations ....and server

Make sure they are all the same...and in the same timezone

MLF

Are you logged into the server or are you attempting to do this through the MMC tools? From the looks of the image you are using the AD MMC from your local machine to make the changes?

I see you have a window opened with RDP to a server. Does any of this work when logged into the DC?

FanaCool,
Having some Event ID's would really help us all out. Check your Event Viewer (as mentioned before) and post any errors that relate to the problem you are experiencing (or that you think relate to the problem). I have found many times that using Event Viewer really helps in isolating the problem, rather than driving yourself nuts trying every solution until one works.

Fana,
I forget if you have one or two DC in your AD. If you haven't already tried log locally to the DC as has been suggested with the domain admin account. If you have two DC's try on thte two if it works on one and not on the other check to see if the replication is working ok. Also ,I don't have a server where i am now so can't give you exact instructions, check that you still have the right to modify the groups policys. Had a case once where a tech changed the policy for the domain thinking if was only for his DC.
Verify your event logs and check the error codes, if any, on the technet site if you haven't already.
Let us know if you get it worked out.
Cheers
Muracu

There is a W32Time error i am getting on the machine:

Event Type: Warning
Event Source: W32Time
Event Category: None
Event ID: 12
Date: 8/10/2006
Time: 6:48:00 PM
User: N/A
Computer: Server
Description:
Time Provider NtpClient: This machine is configured to use the domain hierarchy to determine its time source, but it is the PDC emulator for the domain at the root of the forest, so there is no machine above it in the domain hierarchy to use as a time source. It is recommended that you either configure a reliable time service in the root domain, or manually configure the PDC to synchronize with an external time source. Otherwise, this machine will function as the authoritative time source in the domain hierarchy. If an external time source is not configured or used for this computer, you may choose to disable the NtpClient.



Another Error i see is this : -

Event Type: Error
Event Source: MRxSmb
Event Category: None
Event ID: 8003
Date: 8/10/2006
Time: 6:42:07 PM
User: N/A
Computer: SERVER
Description:
The master browser has received a server announcement from the computer COMPUTER1 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{F8FB0E1A-7C4B-4401-A3. The master browser is stopping or an election is being forced.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........


3)

Event Type: Error
Event Source: NETLOGON
Event Category: None
Event ID: 5513
Date: 8/10/2006
Time: 6:37:02 PM
User: N/A
Computer: SERVER
Description:
The computer COMPUTER2 tried to connect to the server \\SERVEER using the trust relationship established by the MYDOMAIN domain. However, the computer lost the correct security identifier (SID) when the domain was reconfigured. Reestablish the trust relationship.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



4) This issue is there from day one

Event Type: Warning
Event Source: DhcpServer
Event Category: None
Event ID: 1056
Date: 8/10/2006
Time: 6:32:54 PM
User: N/A
Computer: SERVER
Description:
The DHCP service has detected that it is running on a DC and has no credentials configured for use with Dynamic DNS registrations initiated by the DHCP service. This is not a recommended security configuration. Credentials for Dynamic DNS registrations may be configured using the command line "netsh dhcp server set dnscredentials" or via the DHCP Administrative tool.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 ....



5) This is what looks like what would be related to my current issue.

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 8/11/2006
Time: 12:07:59 PM
User: MYDOMAIN\administrator
Computer: SERVER
Description:
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.



I have changed the name of machines in all the errors.


I have Only 1 DC.

Spyrus

The Remote desktop connection is with the internal server, its a database server and i nomrally logged into with from the main server.

Coming back to the main server, i am logged into the server locally and when i try to change the Group policy container i get the message which i have attached.


The DNS is working fine, its running perfectly alright.

I have just notice when more thing here when i Open Group Policy Management Tool there is blue icon with ! mark against the my Domain.

One more thing when I run Group Policy Result on the server machine with the same user In GPO (Group Policy Object) applied GPO shows nothing while denied GPO's Shows 2 one is default and reason for denied is EMPTY and simliarly the NEW GROUP POLICY OBJECT is also Denied for the same reason.

Any comments on it ?

I'd still double-check on DNS. I know that it sounds funny, but you'd be surprised at how many wieird things crop up with DNS problems. It only takes a couple of minutes to check too.

First things first. Make sure that your DC is set to the correct DNS server (I'm assuming that it's going to be the localhost here). Also, after starting the DNS console, right click on the server, go to the logging tab (I think it's the logging tab) and run both simple and recursive queries. If they test OK, you should be good to go.

One of your netlogon errors seems to indicate that you rebuilt the domain at some point. Is this correct?

infernon

As I said earlier the DNS is fine as i have tested both simple and recursive queries both are perfectly alright.

Re-built nops, its in original shape from the day i have installed the OS in it and was running fine from quite a long time.

Interesting...

Heh, I'm buggered. Without looking at the machine, it's difficult to troubleshoot.

If you use the GPO management tool (the new one for Win2k3), it makes it easier to determine the permissions in effect on a certain policy as well as exactly who they apply to. Are you able to find out what the two denials are set for and at what level they apply? Determining how to do this would be the first thing that I did.

Of course, I'm assuming that you've logged on with a domain admin logon and that you're the only domain admin. It isn't possible that someone made a change without your knowledge, is it?

Yes i am the only Domain admin and no other domain user could change these settings, and yes i have installed that new Group Policy Mangement tool for windows 2003 and i am looking through it. What i need to know is that why that Blue icon with ! sign is with my Domain seems something missing.

Since this appears important to solve quickly, I will point out what I noticed.

( be forewarned, I know dick about a DC )

refering to COMPUTER2

Quote:

---

However, the computer lost the correct security identifier (SID) when the domain was reconfigured. Reestablish the trust relationship.

---

( emphasis added )

not getting proper credentials after domain was reconfigured?

Quote:

---

The master browser has received a server announcement from the computer COMPUTER1 that believes that it is the master browser for the domain on transport NetBT_Tcpip_{F8FB0E1A-7C4B-4401-A3. The master browser is stopping or an election is being forced.

---

what is COMPUTER1 ?

Do you routinely see this or is this something new?

Is this a new machine or has it been recently reconfigured?

As I understand it, errors such as this could be caused by XPpro machines not properly configured to mind their own business ( routine ), or by improper subnet masks on a machine, or something else.

What happens when COMPUTER1 is taken off-line?

When was the last time updates were applied ( relative to this problem )?

Also, you had questioned the mention of time. From what I understand, if the times on the machines do not correlate closely when a DC is involved, rejection is the result.

Did searching through logs of clients reveal anything?

Sorry FanacooL, this is a stab in the dark for me. Hopefully, I a least sparked a thought for a solution.

Computer 1: -

Well i haven't noticed this before, after seeing your question i went back to check the log and within this week its coming contineously.

If you are talking about computer 1 nopes its not a new machine and its not been re-configured.

I have updated the server 2 days ago and even today and couldnot find any hotfix or update so far missing the server is uptodate.

Now that you have mentioned let me checkout COMPUTER 1 and see if i can find something over there.

But the issues is not at a particular user end its like my Domain is there but new users or computers can't join in.

OK Fanacool. Let's start sorting this mess out. I'll go by each Event ID and see what I can figure out here.

Event ID 12 (W32 Time) - This error is basically saying your PDC Emulator is setup to look for a time source from a computer that's higher than it, in your domain. If you don't care that this computer (your DC) is your time source for your domain, then no worries. Otherwise, you'll need to configure this computer to retrieve time from an external NTP server. Either way, it's your choice.

Event ID 8003 (MRxsmB) - This event ID has eluded me as to its cause more than once. Check your subnest mask on the computer generating this error and make sure that it is correct in relation to your network configurations. Outside of that, it could be a couple other things. Let me know. You may also want to try and disable the Computer Browser service. As I recall, the PDC Emulator is usually the Computer Browser and clients connected should not have the service enabled? It's been awhile so anyone correct me if I am wrong.

Event ID 5513 (Netlogon) - This error message could be attributed to the computer account information not matching the information on the authenticating domain controller. You may need to reset the account via Active Directory. You should be able to do this by right-clicking on the computer that is generating the error and select "reset account". Also, are you attemtping to join Windows XP SP2 machines? Make sure the firewall is turned off on the XP machine and rejoin it to the domain. Here is Microsoft's Solution to this error.

Event ID 1056 (DHCP) - As I am not familiar with this error, I can only direct you elsewhere. Here is Microsoft's Solution to this issue.

Event ID 1030 (Userenv) - I have had this error a few times and used Microsoft's Solution to fix it. In my case, it was the DFS client causing the error.

Let's start here and see where we go.

Also... you shouldnt have to do it but have you tried deleting that GPO as the Enterprise Admin? Or do you not have the level of access? Being the ultimate account this would be a good place to start.

ShagDevil

I was a little sick and couldn't check the things...... I did follow few things on saturday here's the updates.

Event ID 12 (W32 Time) Did not bother to look into it as its not an alarming thing.

Event ID 8003 (MRxsmB) Network Configuration on the system is fine, regarding the computer browser service I am not clear about that I haven't been told by anyone that this should be disable on the Client end.

Event ID 5513 (Netlogon) I am quite aware of this issue, I need to re-join the client on the Domain but since i am having issues with AD group policy so i can't join anyone on the Domain and gets the same message i get when i try to open the group policy object.

Event ID 1030 (Userenv) Should I be applying this on Client as nothing happen after applying on the server.

Spyrus

I have already tried to delete the GPO but i get a message "SERVER IS UNWILLING TO PROCESS THE REQUEST"

I have came across a very good document relating to this isseue and upon working on the steps i have managed to open the group policy Object but still users are not able to re-join the domain and get access to the server share.

Also if I try to change the GP Object or any other setting in the GPO i get the attached error message.

I know you had tried, I just wasnt sure if you tried as the Enterprise Admin as opposed to just a Domain Admin. As far as rejoining to the domain are the users trying it themselves or are you trying it with a Domain Admin account?

I found this article in regards to your most current error:
http://www.derkeiler.com/Newsgroups/...5-08/0134.html

The users should be assigned the Log On Locally user right in
Domain Controller Security Policy!

However, the default security settings
do not allow regular users to log on interactively at a server. You can
change this setting through Start ,Administrative Tools , Domain Controller
Security Policy. Expand Local Policies, then User Rights Assignment. Doubleclick
Allow Log On Locally and click the Add User Or Group button. In the Add
User Or Group dialog box, type in Everyone and click the OK button. In the
Security Policy Setting dialog box, click the OK button.

Hope this help..

cdre

If you would have read all of my posts the issue is related with Policies and thats the thing i am unable to access and gets that error message i have posted in my first post. Sometimes i do get into the option where i can change the policies but when i try to save them i get another message "An extended Error has occured failed to save domain\sysvol\domain\policies\{6AC17........}\machine\Microsoft\WindowsNT\SecEdit\GPtTmpl.inf.

Spyrus

I am trying to join them back on domain from Domain admin as well as Enterprise Admin account and gets the same error message. (Refer to my first Post)

I am looking at your link, although i have found the exact document relating to my issue its 14 pages long with lots of steps I will work over it and will post the results to you.

http://support.microsoft.com/kb/887303/en-us

I have noticed one more thing when i run nslookup i get ns1.myisp.domain and its IP address, shouldn't it be my server machine name and its IP.

If it is configured as your name server then yes it should be... but if none of your PC's can join it and you are having multiple issues (which you are) then it might not be working properly


http://support.microsoft.com/kb/237675/

Did I not hear DNS earlier in this thread...... :eek:

MLF

Morganlefay

I did heard for DNS too, but anyways just came across the thing that DNS settings are ok SYSVOL folder seems to be the issue here and i am working on it, hopfully this is the cause of all the mess-up i have. I will update in a while after working on it.

Dear All,

Thank fully Issued got resolved, how do i proceed with it. I checked all the settings of SYSVOL folder and followed steps mentioned in Microsoft Article 290647, 315457 result nothing happen. So the last option for me was to get rid of this AD, I went for it and what happen was still the issue was there i got the same message when i try to access the machine. Initially i got di-hearted that i have to go for complete installation but I came across the thing that it has to be something in Local security Policy and so i try to find our things in it, upon exploring it and getting help from Microsoft website i came across the option "allow this computer to access across network option containg no profile in it" i mean none of the account was existing in that option.......:-( Similarly one more setting from security policy and things back to normal.

Although it took me a hell lot of time to re-create user accounts, but overall i have learnt lots of new things from this experience. I thankyou all for your support. God Bless you.