Group Policy Windows Server 2003

Clarifications

Edited by moderator

Message was edited by: beth.blakely@...

looked at eventid.net yet lantern? Sometimes they cna be helpfull, and worth the $24 a year for a membership.

with this reg
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"UserEnvDebugLevel"=dword:00010002

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics]
"FdeployDebugLevel"=dword:0x0f

then reboot and login.
The log file is C:\WINDOWS\Debug\UserMode\userenv.log

much information is there.

also visit:http://support.microsoft.com/kb/329708
and http://support.microsoft.com/kb/291382/

1. If your clients are running DHCP pull up a command prompt and type "ipconfig /release" and then "ipconfig /renew".

Also type "gpupdate /force"

2. Try rejoining clients to domain. Control Panel>System>Computer Name>Change. If your domain is ex: "nokia.local" just delete the ".local" part and click OK.

3. Make sure the File Replication Service is started on your domain controllers. This will replicate Group Policy.

Hey greenlantern,

I was going to check your event id's but they lacked a
source so I am guessing on the 1053 that it was userenv.
Also, I am going to assume some things so if I am wrong
please just let me know the details. SI am assuming the
Domain is 2003 based. Is DHCP on the Domain controller
or a dsl/router? Is DNS on a domain controller or a dsl/
router? Have you checked the ipconfig for proper ip setup?

If there is network connectivity, and I assume there is
since you said roaming profiles work, it is most likely
Time/Date, Domian rejoin, or DNS. I would guess/bet
DNS. Windows XP etc want DNS for logon. Many small
companies have a cable dsl router that use for dhcp and
dns. Then they setup Active Directory and have issues. All
Active Directory services are registered in DNS on a
windows domain so to find them the client must use the
windows DNS, not the router.

If it is the DNS, make sure the client has the proper DNS
setting and that the domain controller is properly
registered with DNS. Try this kb article:

http://support.microsoft.com/kb/310461

also try from the server:

ipconfig /registerdns to re-register SRV records.

If it is as simple as a time/date issue then make sure you
have all the times and dates on the server and clients
correct.

For the the domain issue, As someone else mentioned,
remove the client from the domain and re-join. Just join a
workgroup, then back to the domain. (My Computer ->
Properties -> Computer Name).

Good luck,

razz

You can get these errors when you have spanning-tree enabled on your switch ports (usually the default). You can check this easily by plugging something into an empty switch port. If the light stays amber for 30-50 seconds before turning green then spanning-tree is on. If it turns green immediately then it is off. Spanning-tree only needs to be on if the port is connected to another switch to prevent switching loops. The problem is that the port does not forward packets until spanning-tree determines that there is no loop (when the light turns green). So until then the computer cannot contact the domain and certain group policies like folder redirection will not process.

You can turn off spanning-tree per switchport. On a Cisco switch you need to enable "portfast" on each switchport. On an Adtran I think it is called "edgeport". Anyway, find this option on whatever brand switch that you have.

They are all just hoping that I'll open an Air Lock as they get near one and put them and their tiny little minds out of their misery. :0

Col

and I can see right away how that would be a problem in the odd place or two, like maybe a client will not update its dns records correctly or time out if dhcp requests if loads are heavy on the router. But DNS would be the issue if they never configed the router to use the LAN DNS and then didnt point the lan DNS to use the IP DNS as a forwarder.

RESOLUTION
For a Microsoft Windows XP-based computer or a Microsoft Windows Server 2003-based computer that is joined to a Windows NT 4.0 domain, to turn off the Autoenrollment feature in the Local Group Policy, follow these steps on the local workstation: 1. Click Start, click Run, type gpedit.msc, and then press ENTER.
2. In the left pane, expand Computer Configuration, expand Windows Settings, expand Security Settings, and then expand Public Key Policies.
3. Double-click Autoenrollment Settings.
4. Click Do not enroll certificates automatically.
5. Click OK.
6. Repeat steps 2 through 5, but in step 2, expand User Configuration, expand Windows Settings, expand Security Settings, and then expand Public Key Policies.
7. Close the Group Policy window.
For a computer that is a member of a Windows 2000 or later Active Directory domain, make sure that the domain member has network connectivity with at least one domain controller.

After you have determined that you have good Internet Protocol (IP) connectivity between the member and a domain controller, correct the DNS address in the IP properties of the workstation. To do this, follow these steps: 1. Start the Network Connections tool in Control Panel.
2. Right-click Local Area Connection, and then click Properties.
3. Click Internet Protocol (TCP/IP), and then click Properties.
4. Type the correct DNS address in the Preferred DNS server box

http://support.microsoft.com/?id=310461

Well the mostly needed are the GC-related SRV records..

All the GC's in the domain be registered...

RESOLUTIONS
============
1. Restarted the Netlogon service on the GC to re-register the GC records

2. Also Disable the auto scavenging on DNS.