Fixing Group Policy Replication issues


I ran into an issue where GPUpdate kept returning the error below:

"Computer policy could not be updated successfully.  The following errors were encountered: The processing of Group Policy failed.  Windows attempted to read the file \\COMPANY.LOCAL\sysvol\<FQDN>\Policies\{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}\gpt.ini from a domain controller and was not successful.  Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:

a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

To diagnose the failure, review the event log or invoke gpmc.msc to access information about Group Policy results."

In my case the DCs got out of sync and the fix was to complete an authoritative restore of SYSVOL

Solution:

Backup your SYSVOL folders before following any of these steps. If something goes wrong during the process all files could be deleted.

See replication status


  • Make sure SYSVOL is advertising
    • Dcdiag /e /test:sysvolcheck /test:advertising
    • For /f %i IN ('dsquery server -o rdn') do @echo %i && @wmic /node:"%i" /namespace:\\root\microsoftdfs path dfsrreplicatedfolderinfo WHERE replicatedfoldername='SYSVOL share' get replicationgroupname,replicatedfoldername,state
      • All servers should be in state 4 (Normal)
      • https://support.microsoft.com/en-us/help/2958414/dfs-replication-how-to-troubleshoot-missing-sysvol-and-netlogon-shares
    • Use Active Directory Replication Status Tool to find issues

Fix SYSVOL




Comments

Popular posts from this blog

FSLogix Troubleshooting guide

Best Practices for Deploying User Profile Disks

Removing Application UAC Requirements with Shims