# GPOs not Applying



## parrot1553

Hello,

I have a few GPOs linked into OUs,but none of them apply.If I run gpresult /r on one of the client computers I get this:

The processing of Group Policy failed. Windows could not apply the registry-base
d policy settings for the Group Policy object LDAP://CN=User,cn={FDF06D2C-782F-4
498-8A4C-18342880CFC2},cn=policies,cn=system,DC=gimo,DC=local. Group Policy sett
ings will not be resolved until this event is resolved. View the event details f
or more information on the file name and path that caused the failure.
Computer policy could not be updated successfully. The following errors were enc
ountered:

The processing of Group Policy failed. Windows could not evaluate the Windows Ma
nagement Instrumentation (WMI) filter for the Group Policy object cn={EAF42392-3
29D-4219-81F7-A17F1F64E499},cn=policies,cn=system,DC=gimo,DC=local. This could b
e caused by RSOP being disabled or Windows Management Instrumentation (WMI) ser
vice being disabled, stopped, or other WMI errors. Make sure the WMI service is
started and the startup type is set to automatic. New Group Policy objects or se
ttings will not process until this event has been resolved.

















How can I solve this?

Thanks


----------



## lochlomonder

Have a look here first and foremost. Also, try running *gpupdate /force* from the CLI and see what feedback this gives you. It's also worthwhile checking in the Event Viewer system log of an affected workstation, after running that command, to see if it'll shed any more light on the matter for you.


----------



## parrot1553

sorry I meant gpupdate /force ,not result.Thats what give me the error.However I checked the event log and these are the errors:
A Kerberos Error Message was received:
on logon session 
Client Time: 
Server Time: 0:15:12.0000 5/13/2017 Z
Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN
Extended Error: 
Client Realm: 
Client Name: 
Server Realm: GIMO.LOCAL
Server Name: DNS/auth1.dns.cogentco.com
Target Name: DNS/[email protected]
Error Text: 
File: 9
Line: f0a
Error Data is in record data.

A Kerberos Error Message was received:
on logon session GIMO.LOCAL\pc000129$
Client Time: 
Server Time: 23:6:24.0000 5/12/2017 Z
Error Code: 0x19 KDC_ERR_PREAUTH_REQUIRED
Extended Error: 
Client Realm: 
Client Name: 
Server Realm: GIMO.LOCAL
Server Name: krbtgt/GIMO.LOCAL
Target Name: krbtgt/[email protected]
Error Text: 
File: e
Line: a05
Error Data is in record data.

How do I fix this?


----------



## peterh40

Check the time on your PC is <=5 mins of the time on the main PDC server.
Make sure that your PC can talk to the PDC over the network.
Check to see if you can browse to \\pdc-server\sysvol share.


----------



## parrot1553

Time is same.I can browse the sysvol share.


----------



## peterh40

Are you using Kerberos Authentication in your domain?
Check for duplicate SPN entries - use SETSPN.exe /X to locate them.


----------



## parrot1553

I don't know.Isnt kerberos used by default on a domain?
I have disabled kerberos authentication via properties->account tab in AD for my user.
I also ran SetSPN command and it found 0 duplicated.
Also ran wmi repository verify check,came out with"consistent".

I am at a loss here at whats going on.I don't know what previous IT guys have done,but the system has been set up long ago.I can't afford to experiment as there are 300+ people on the domain.


----------



## peterh40

If you have access to the AD tools, load up Active Directory Users and Computers console from Administrative Tools on your PC and use Find to search for your Computer account and User account to see where they are in the domain. If the computer accounts is in the default Computers container, then you need to moving to the correct place for your department.

How to use AD Users and Computers


----------



## parrot1553

Hi,The GPOs are linked in the correct OUs (GPO with user configuration in the OU with users,GPO with Computer Configuration in the OU with computers).

So after further investigation.It seems like when I remove the GPO that gives me the error when I run gpupdate /force ,the command completes successfully.So it seems the GPO itself is corrupt,however,when I create a new GPO it automatically becomes corrupt.What is most likely causing this issue? I ran a quick chkdsk and it showed no errors,I'd have to turn server off for a more thorough test but I'd prefer to avoid that.


----------



## peterh40

On recent version of Windows, the computer caches the GPO files locally, so it may be the cache is corrupt rather than the ones on the DC server. Try clearing out the GPO cache:

https://www.lansweeper.com/forum/yaf_postst6507_Reset-Group-Policy-Cache.aspx#post28142


----------



## parrot1553

clearing out the gpo cache on 200 computers?


----------



## lochlomonder

Not necessarily 200. Start with 1 as your baseline and then see if this sorts the issue.



> So it seems the GPO itself is corrupt...


It's not necessarily corrupt per se, but perhaps what you're trying to achieve with the GPO is causing issues. Have you used RSoP before on any of the client workstations to see what results this will yield?


----------



## parrot1553

Hi ,

I have run RSOP and this is the result file.

https://www.dropbox.com/s/i47khdwcl0da59k/gpreport.html?dl=0


----------



## lochlomonder

Looking at the Registry error, I'm wondering if there's an issue with writing to the Registry (possibly a permissions issue). From the report: "_Additional information may have been logged. Review the Policy Events tab in the console or the application event log for events between *24/05/2017 17:09:21 and 24/05/2017 17:09:21*_." Have a look in Event Viewer, Windows Logs, Application and see what shows up on one of the affected PCs showing the time frame I noted in bold.

In addition to gleaning more information, run this command from the CLI on one of the affected workstations: *gpresult /z > %userprofile%\desktop\gpresult.txt*. This will create a text file on the logged-on user's desktop which provides information on the Computer and User settings applied by GPOs, and this may shed some more light on the issue.

If you could remove personal information from it such as the domain name and post it back here, I'll have a look over that as well.


----------



## parrot1553

Hi,

I think its pretty obvious but I changed the domain name to "hidden" .I couldn't possible change it everywhere its too much.

anyhow,heres the gpresult export and also the event log.All these are from my computer,which is just one of the many in the domain that don't get any new GPOs applied.Currently its not working for any computers ,so I am 100% sure its the server.Active directory however is working fine and new computers can join the network and log in with domain accounts.

Hope it helps!


----------



## parrot1553

bump


----------



## lochlomonder

Apologies for the delay. I would recommend looking at this page and following the instructions for Server 2003. I know you're likely not using that OS, but the fix is still extant for 2008 and 2012.


----------



## parrot1553

Hi ,I've done everything on that page and all settings seem to be ok.However the issue is still not resolved...


----------



## lochlomonder

Okay, there are a couple of things to try here. I'm guessing (hoping) you have more than one DC, so log into each of them, run *services.msc*, and then ensure you restart the *File Replication Service* on each. Give it a while and then run dcdiag on one of the DCs to see what that reports for you.


----------



## parrot1553

I have only one DC.I did restart the service,no change.Something funny I noticed,not sure if I mentioned it before.When I run gpupdate and get the following:

The processing of Group Policy failed. Windows could not apply the registry-base
d policy settings for the Group Policy object LDAP://CN=User,cn={FDF06D2C-782F-4
498-8A4C-18342880CFC2},cn=policies,cn=system,DC=gimo,DC=local. Group Policy sett
ings will not be resolved until this event is resolved. View the event details f
or more information on the file name and path that caused the failure.
Computer policy could not be updated successfully. The following errors were enc
ountered:

The processing of Group Policy failed. Windows could not evaluate the Windows Ma
nagement Instrumentation (WMI) filter for the Group Policy object cn={EAF42392-3
29D-4219-81F7-A17F1F64E499},cn=policies,cn=system,DC=gimo,DC=local. This could b
e caused by RSOP being disabled or Windows Management Instrumentation (WMI) ser
vice being disabled, stopped, or other WMI errors. Make sure the WMI service is
started and the startup type is set to automatic. New Group Policy objects or se
ttings will not process until this event has been resolved.

If I disable or remove {FDF06D2C-782F-4498-8A4C-18342880CFC2} it will just point to another GPO.If I remove all GPOs under Users OU,the gpupdate will complete successfully,however ,even if I create a new GPO the error points to it.I don't know what the previous IT were doing but I've never seen something like this.My manager is pushing me to fix it tho as its quite important,as current GPOs dont work on Any computers(only the gpos applied in the past are still active and not removed on the client pcs)

At this point I am willing to give someone remote access to fix it,even tho thats forbidden .
We have over 300 users tho,so I really try not to play around with it too much,atleast we can still create domain users and connect new computers to the domain and for people to access network folders.

We have Daily full backups ,but thats gonna take forever and I dont get paid for overtime hours.


----------



## lochlomonder

Did you run dcdiag?

Just a side note, although I know this isn't germane to the task at hand: for the sake of redundancy and ensuring the domain is available in the event of a server failure, I'd definitely recommend you speak with your boss about adding a second DC to the domain.


----------



## parrot1553

Hi,sorry for late reply,a lot going on recently.I have run dcdiag:
Also attached photo with the current permissions,I added Everyone and inherited to child subfolders and files hoping it would fix it but same thing...




Performing initial setup:
Trying to find home server...
Home Server = server00
* Identified AD Forest.
Done gathering initial info.

Doing initial required tests

Testing server: Default-First-Site-Name\SERVER00
Starting test: Connectivity
......................... SERVER00 passed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\SERVER00
Starting test: Advertising
......................... SERVER00 passed test Advertising
Starting test: FrsEvent
......................... SERVER00 passed test FrsEvent
Starting test: DFSREvent
There are warning or error events within the last 24 hours after the SYSVOL has been
shared. Failing SYSVOL replication problems may cause Group Policy problems.
......................... SERVER00 passed test DFSREvent
Starting test: SysVolCheck
......................... SERVER00 passed test SysVolCheck
Starting test: KccEvent
......................... SERVER00 passed test KccEvent
Starting test: KnowsOfRoleHolders
......................... SERVER00 passed test KnowsOfRoleHolders
Starting test: MachineAccount
......................... SERVER00 passed test MachineAccount
Starting test: NCSecDesc
......................... SERVER00 passed test NCSecDesc
Starting test: NetLogons
......................... SERVER00 passed test NetLogons
Starting test: ObjectsReplicated
......................... SERVER00 passed test ObjectsReplicated
Starting test: Replications
......................... SERVER00 passed test Replications
Starting test: RidManager
......................... SERVER00 passed test RidManager
Starting test: Services
......................... SERVER00 passed test Services
Starting test: SystemLog
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:27:20
Event String:
Driver Brother HL-L2360D series required for printer Big Brother is unknown. Contact the
administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:27:20
Event String:
Driver Brother HL-L8250CDN series required for printer Brother HL-L8250CDN series is unk
nown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:27:22
Event String:
Driver hpfax1 required for printer HP Color LaserJet CM1312 MFP Series Fax is unknown. C
ontact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:27:23
Event String:
Driver HP Color LaserJet CM1312 MFP Series PCL 6 required for printer HP Color LaserJet
CM1312 MFP Series PCL 6 is unknown. Contact the administrator to install the driver before you log i
n again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:27:23
Event String:
Driver HP Universal Printing PCL 6 required for printer HP Color LaserJet CM1312nfi MFP
(10.1.10.236) is unknown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:27:24
Event String:
Driver HP Universal Printing PCL 6 required for printer HP Universal Printing PCL 6 is u
nknown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:27:26
Event String:
Driver Send To Microsoft OneNote 2010 Driver required for printer Send To OneNote 2010 i
s unknown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0xC00A0032
Time Generated: 06/13/2017 10:33:32
Event String:
The RDP protocol component X.224 detected an error in the protocol stream and has discon
nected the client.
An error event occurred. EventID: 0xC00A0038
Time Generated: 06/13/2017 10:33:32
Event String:
The Terminal Server security layer detected an error in the protocol stream and has disc
onnected the client. Client IP: 2001:0978:2300:0300:f5e2:6338:b896:4572.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:33:47
Event String:
Driver Brother HL-2280DW Printer required for printer Brother HL-2280DW Printer is unkno
wn. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:33:49
Event String:
Driver Adobe PDF Converter required for printer Adobe PDF is unknown. Contact the admini
strator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:33:49
Event String:
Driver HP Universal Printing PCL 5 required for printer HP Universal Printing PCL 5 is u
nknown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:33:50
Event String:
Driver HP Universal Printing PCL 6 required for printer HP LaserJet 400 colorMFP M475dw
UPD PCL 6 is unknown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:33:50
Event String:
Driver HP Universal Printing PCL 6 required for printer HP Universal Printing PCL 6 is u
nknown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:33:51
Event String:
Driver Send to Microsoft OneNote 16 Driver required for printer Send To OneNote 2016 is
unknown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:33:51
Event String:
Driver Samsung CLX-3180 Series required for printer Samsung CLX-3180 Series is unknown.
Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:33:52
Event String:
Driver Brother HL-L8250CDN series required for printer Main Printer Ground Floor is unkn
own. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:33:52
Event String:
Driver HP Universal Printing PCL 6 required for printer Printer in front of Saj's is unk
nown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:51:42
Event String:
Driver Brother HL-L2360D series required for printer Big Brother is unknown. Contact the
administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:51:42
Event String:
Driver Brother HL-L8250CDN series required for printer Brother HL-L8250CDN series is unk
nown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:51:43
Event String:
Driver hpfax1 required for printer HP Color LaserJet CM1312 MFP Series Fax is unknown. C
ontact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:51:44
Event String:
Driver HP Color LaserJet CM1312 MFP Series PCL 6 required for printer HP Color LaserJet
CM1312 MFP Series PCL 6 is unknown. Contact the administrator to install the driver before you log i
n again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:51:44
Event String:
Driver HP Universal Printing PCL 6 required for printer HP Color LaserJet CM1312nfi MFP
(10.1.10.236) is unknown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:51:45
Event String:
Driver HP Universal Printing PCL 6 required for printer HP Universal Printing PCL 6 is u
nknown. Contact the administrator to install the driver before you log in again.
An error event occurred. EventID: 0x00000457
Time Generated: 06/13/2017 10:51:45
Event String:
Driver Send To Microsoft OneNote 2010 Driver required for printer Send To OneNote 2010 i
s unknown. Contact the administrator to install the driver before you log in again.
......................... SERVER00 failed test SystemLog
Starting test: VerifyReferences
......................... SERVER00 passed test VerifyReferences


Running partition tests on : ForestDnsZones
Starting test: CheckSDRefDom
......................... ForestDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... ForestDnsZones passed test CrossRefValidation

Running partition tests on : DomainDnsZones
Starting test: CheckSDRefDom
......................... DomainDnsZones passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... DomainDnsZones passed test CrossRefValidation

Running partition tests on : Schema
Starting test: CheckSDRefDom
......................... Schema passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Schema passed test CrossRefValidation

Running partition tests on : Configuration
Starting test: CheckSDRefDom
......................... Configuration passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... Configuration passed test CrossRefValidation

Running partition tests on : gimo
Starting test: CheckSDRefDom
......................... gimo passed test CheckSDRefDom
Starting test: CrossRefValidation
......................... gimo passed test CrossRefValidation

Running enterprise tests on : gimo.local
Starting test: LocatorCheck
......................... gimo.local passed test LocatorCheck
Starting test: Intersite
......................... gimo.local passed test Intersite

C:\Users\Administrator>


----------

