Hello everyone!
I’m having an interesting problem with a Windows Server 2003 Domain Controller.
This unit is running R1, not R2, is a secondary Domain controller, runs DHCP, secondary DNS, and is our primary print server.
Our Primary DC is a file server and primary DNS. Our tertiary DC is a pure DC, but is at a remote location.
Now that you know the background, here’s the situation:
PDC updates GPO just fine. It uses the GPO I created: “T Domain Controller GPO”. All settings are applied and I get the A-OK from the event viewer. Running GPRESULT gives me the correct info, and I have no issues with it.
The Secondary DC, however, does not. I get numerous “Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.” errors in the event log, and it does not pull settings at all. Below is a comparison of GPRESULT information:
Primary DC:
—————–
RSOP data for AEROSPACE\Administrator on PDC : Logging Mode
——————————————————————–
OS Type: Microsoft(R) Windows(R) Server 2003, Standard Editi
on
OS Configuration: Primary Domain Controller
OS Version: 5.2.3790
Terminal Server Mode: Remote Administration
Site Name: Default-First-Site-Name
Roaming Profile:
Local Profile: C:\Documents and Settings\Administrator
Connected over a slow link?: No
COMPUTER SETTINGS
——————
CN=PDC,OU=Domain Controllers,DC=aerospace,DC=com
Last time Group Policy was applied: 1/10/2008 at 11:37:39 AM
Group Policy was applied from: PDC.aerospace.com
Group Policy slow link threshold: 500 kbps
Domain Name: AEROSPACE
Domain Type: Windows 2000
Applied Group Policy Objects
—————————–
T Domain Controllers Policy
The following GPOs were not applied because they were filtered out
——————————————————————-
Local Group Policy
Filtering: Not Applied (Empty)
The computer is a part of the following security groups
——————————————————-
BUILTIN\Administrators
Everyone
BUILTIN\Pre-Windows 2000 Compatible Access
BUILTIN\Users
Windows Authorization Access Group
NT AUTHORITY\NETWORK
NT AUTHORITY\Authenticated Users
This Organization
PDC$
Domain Controllers
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
USER SETTINGS
————–
CN=Administrator,OU=Administrators,DC=aerospace,DC=com
Last time Group Policy was applied: 1/10/2008 at 11:07:09 AM
Group Policy was applied from: PDC.aerospace.com
Group Policy slow link threshold: 500 kbps
Domain Name: AEROSPACE
Domain Type: Windows 2000
Applied Group Policy Objects
—————————–
Administrative Policy
The following GPOs were not applied because they were filtered out
——————————————————————-
Domain Computer Group Policy
Filtering: Disabled (GPO)
Unrestricted Domain Computer Group Policy
Filtering: Disabled (GPO)
Domain Laptop Group Policy
Filtering: Disabled (GPO)
Test MSI Pusher GPO
Filtering: Disabled (GPO)
Local Group Policy
Filtering: Not Applied (Empty)
The user is a part of the following security groups
—————————————————
Domain Users
Everyone
BUILTIN\Administrators
BUILTIN\Users
BUILTIN\Pre-Windows 2000 Compatible Access
REMOTE INTERACTIVE LOGON
NT AUTHORITY\INTERACTIVE
NT AUTHORITY\Authenticated Users
This Organization
LOCAL
Domain Admins
Executive_BC
Group Policy Creator Owners
Enterprise Admins
Schema Admins
——————
Now take a look at the Secondary DC log: (SDC)
——————
RSOP data for AEROSPACE\Administrator on SDC : Logging Mode
——————————————————————–
OS Type: Microsoft(R) Windows(R) Server 2003, Standard Edit
on
OS Configuration: Additional/Backup Domain Controller
OS Version: 5.2.3790
Terminal Server Mode: Remote Administration
Site Name: Default-First-Site-Name
Roaming Profile:
Local Profile: C:\Documents and Settings\Administrator
Connected over a slow link?: No
COMPUTER SETTINGS
——————
CN=SDC,OU=Domain Controllers,DC=aerospace,DC=com
Last time Group Policy was applied: 1/10/2008 at 11:38:14 AM
Group Policy was applied from: SDC.aerospace.com
Group Policy slow link threshold: 500 kbps
Domain Name: AEROSPACE
Domain Type: Windows 2000
Applied Group Policy Objects
—————————–
T Domain Controllers Policy
The following GPOs were not applied because they were filtered out
——————————————————————-
Local Group Policy
Filtering: Not Applied (Empty)
The computer is a part of the following security groups
——————————————————-
BUILTIN\Administrators
Everyone
BUILTIN\Pre-Windows 2000 Compatible Access
BUILTIN\Users
Windows Authorization Access Group
NT AUTHORITY\NETWORK
NT AUTHORITY\Authenticated Users
This Organization
Domain Controllers
NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS
USER SETTINGS
————–
CN=Administrator,OU=Administrators,DC=aerospace,DC=com
Last time Group Policy was applied: 1/10/2008 at 11:28:14 AM
Group Policy was applied from: SDC.aerospace.com
Group Policy slow link threshold: 500 kbps
Domain Name: AEROSPACE
Domain Type: Windows 2000
Applied Group Policy Objects
—————————–
Default Domain Policy
The following GPOs were not applied because they were filtered out
——————————————————————-
Main Site Policy
Filtering: Not Applied (Empty)
Local Group Policy
Filtering: Not Applied (Empty)
The user is a part of the following security groups
—————————————————
Domain Users
Everyone
BUILTIN\Administrators
BUILTIN\Users
BUILTIN\Pre-Windows 2000 Compatible Access
REMOTE INTERACTIVE LOGON
NT AUTHORITY\INTERACTIVE
NT AUTHORITY\Authenticated Users
This Organization
LOCAL
Domain Admins
Group Policy Creator Owners
Enterprise Admins
Schema Admins
I cannot really see any problems, except that it says it cannot query the list for GPO… when it’s querying itself. Please let me know if you see something I’m not.
