Win 2003 domain: Reason Denied - Empty

T

TheSmJ

2[H]4U
Joined
Dec 20, 2006
Messages
2,749
At work I have a Windows AD domain, and about 160 computers joined. These 160 computers can all see and utilize GPOs on the domain without any issue.

The problem I'm having is that some of these systems are going off lease and are getting replaced. According to GPResult, after being joined to the domain, these new computers won't apply any GPOs aside from the default "Master Default Domain Policy". A handful (but not all) of the GPOs are under "Denied GPOs" with the reason denied being "empty". I know for a fact that these GPOs are not empty, and other computers are using them just fine. Furthermore, a security group I added one of the systems to doesn't show up at all within GPResult, even after waiting for replication, gpupdate /force, rebooting, etc.

The new and old machines are in the same OU. Many of these GPOs are set to apply to "Authenticated Users" and are linked to the root of the domain. The GPOs that don't show up at all are linked to the specific OU these computers are in.

I've never seen this problem before. What am I missing? It seems like it could be a permissions issue, however everything looks correct to me.
 
Move them out of that OU to a normal folder. Reboot

Put them back in the OU and then reboot,

See if the policies apply.
 
schizrade said:
What does dcdiag tell you?
Click to expand...

I've never actually used this utility, but these are the errors that I get after running it on one of the DCs:

Starting test: NCSecDesc
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=ForestDnsZones,DC=MIS,DC=DOMAIN,DC=COM
Error NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS doesn't have
Replicating Directory Changes In Filtered Set
access rights for the naming context:
DC=DomainDnsZones,DC=MIS,DC=DOMAIN,DC=COM
......................... DOMAIN failed test NCSecDesc


Starting test: SystemLog
A warning event occurred. EventID: 0x80040FA6
Time Generated: 08/05/2015 13:45:09
(Event String (event log = System) could not be retrieved, error
0x3afc)


EDIT:

I read the NCSecDesc error is normal when running dcdiag on a Win2K8 server off of a Win 2K3 domain. I ran the same command on the primary DC and didn't see this error. The only error given was for SystemLog.
 
are these new computers branded like Dell or HP? do they have the default windows load on them? or were they wiped and loaded from regular MS install media?
 
bloodypulp said:
sounds like replication issue.
run dcdiag and repadmin tools
Click to expand...

I checked all the DCs and they all have the GPOs I created. Nothing seems out of place.
dcdiag logs are above. Ran "repadmin /showreps" and it was successful everywhere.

Zedicus said:
are these new computers branded like Dell or HP? do they have the default windows load on them? or were they wiped and loaded from regular MS install media?
Click to expand...

All machines are HPs, but have a custom image created from a regular install disk.
 
Last edited:
build a test script, have it do something trivial, and place it in the USER section of a GPO and make sure it is in a user based OU and have a valid user logo on to one of the new computers and verify that it works. provided it does work we can work backwards on cleaning up the broken computer section. (it probably comes from a failed GPO loop). try the user GPO that i suggested first and we will go from there.
 
Sorry about the lack of updates to this thread guys. There's been a discovery!

Computer GPOs are working on both new and old machines. The issue is the account I'm logging in with doesn't have the rights on these machines to view the GPOs, despite the fact that I'm on the Domain Admins group, and this group is in the local Administrators group on all machines (new and old). This isn't a problem on the old machines.

So now I at least know that the GPOs are running as they should. But I'm left with a new issue: Why is my domain admin account not the domain admin on new machines?
 
TheSmJ said:
Sorry about the lack of updates to this thread guys. There's been a discovery!

Computer GPOs are working on both new and old machines. The issue is the account I'm logging in with doesn't have the rights on these machines to view the GPOs, despite the fact that I'm on the Domain Admins group, and this group is in the local Administrators group on all machines (new and old). This isn't a problem on the old machines.

So now I at least know that the GPOs are running as they should. But I'm left with a new issue: Why is my domain admin account not the domain admin on new machines?
Click to expand...

The real question is have you added the computer to the Novell Groupware Client Address List, and if so is the machine POSIX-compatible with the new BUS software that operates the interconnect link between both hardware and interpose software? Check to make sure Notus Lotes is correctly configured and initialized, loltherwise you can have some incompatibilities.

If I had to venture a guess, I'd say the issue is RAM!

Can I have money now?

Related

Simpsons%2B-%2BInternet%2BKing%2B-%2BComic%2BBook%2BGuy%2B-%2BCaptain%2BJaneway%2B%2528Low%2529.mp4_snapshot_00.39_%255B2015.08.10_16.27.34%255D.jpg
 
Last edited:
You must log in or register to reply here.
Back
Top