Windows Forum

Ask something
Discussion Locked

Group Policy not updating on DC

0 helpful
11 replies

by aaube 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

My Domain Controller (Windows 2000 SP1) no longer receives Group Policy updates. I no longer get the periodic EventID 1704, Source: SceCli in the Application Log. Changes I try to make to the Default Domain Policy (password policies) do not update, even when using secedit to force a refresh.

I can think of no changes that occured around the time Group Policy stopped updating.

I have tried restarting the server, and using netdiag, dcdiag, and gpotool. Restarting the server did not help, and the utilities found no problems.

The only clue I have is an error message that I found after turning on the userenv.log debugging and running secedit:

RefreshPolicy: Entering with 1
RefreshPolicy: Failed to open event with 2
RefreshPolicy: Leaving

I have searched Google, Google Groups, Microsoft's KB, Microsoft's newsgroups (even posted a message about it), and have found no solutions.

11 replies

by voldar

Try to rebuild your GP using the security templates:
- DCFirst.inf
- DefltDC.inf
- DCUp.inf
located in %systemroot%\inf folder

by wtkool

I think that your problem is DNS related. The error event 2 is "file not found" If you are running DNS properly then the server would be pointing to it's self for DNS and the server set up to forward to the ISP DNS for internet access. All your clients should only be pointing to the DC for DNS resolution and no where else. If this wasn't the way you have it configured then change it and make sure that your DNS server is AD integraded. After you make the changes run in a command prompt on the server: net stop netlogon then ipconfig /flushdns then ipconfig /registerdns then net start netlogon. Check and make sure your server has registered properly in DNS and reboot your clients. Your GPO will flow smoothly down to your clients now.

by wtkool

In addition to my solution above you should upgrade to atleast service pack 3 or 4 if possible but this would not be neccesary to resolve your issue.

by aaube

The clients receive Group Policy updates just fine - the problem is with the DC. And my DNS has been setup correctly since before the Group Policy updates on the DC stopped.

by wtkool

I tried to answer yesterday based on the info that you supplied. Password policy set in the default domain policy may not affect the DC because generally the groups that logon to a server are admins and they usually do not have read and apply group policy associated with them in the security tab of the GPO. If your policies are flowing to all other OUs then it is obviously working. Check the security settings on the default domain policy and then check the default domain controller policy and see if the inheritance tab is checked or not. You said that you have used netdiag, dcdiag, and gpotool. What were the results of the utilities? The userenv above event 2 does mean "file not found" that could be that it does not apply to the user who is logged on at the time or other issues.

by aaube

We finally got Service Pack 4 installed on the DC, and the problem disappeared. It must have been an undocumented bug.

This discussion is closed to new replies.