Yes, exactly. Join a workgroup, reboot, join domain, reboot. Voila! From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Dustin Hand Sent: Wednesday, February 28, 2007 4:54 PM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Re: GPO not getting distributed? Does that mean I need to remove them from the domain, the rejoin them? I am not currently at the office right now, so I cant tell you if it works right away, but I can let you know tommorow afternoon. Dustin On 2/28/07, Darren Mar-Elia <darren@xxxxxxxxxx> wrote: One possibility is that the machine accounts have lost their trust with the domain. You might try rejoining one or two of the unhealthy workstations to the domain as a starting point. From: gptalk-bounce@xxxxxxxxxxxxx [mailto: <mailto:gptalk-bounce@xxxxxxxxxxxxx> gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Dustin Hand Sent: Wednesday, February 28, 2007 4:35 PM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Re: GPO not getting distributed? There is no firewall on a coupl,e of the machines, and the policy is not getting applied on them either. I realise that neither of them is particularly healthy. Thats part of te reason they have requested that I work on it. What can be determined, just by looking at the logs, what might assist in making this network healthier? I wouldnt know what might be causing the DC to be unresponsive to the clients. Is there some way I can find out if it is responding to the clients? Dustin On 2/28/07, Darren Mar-Elia <darren@xxxxxxxxxx> wrote: Sorry for the delayed response Dustin. Frankly neither log below looks particularly healthy but if I focus on the green one, then 1722 is RPC server is unavailable. Do you have firewall between your Win2K clients and your DCs? That would be the most likely explanation there-that firewalls are blocking authentication of the Win2K boxes to their DCs. Otherwise, the DCs are somehow non-responsive to those clients. Darren From: gptalk-bounce@xxxxxxxxxxxxx [mailto: <mailto:gptalk-bounce@xxxxxxxxxxxxx> gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Dustin Hand Sent: Tuesday, February 27, 2007 1:32 PM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] Re: GPO not getting distributed? Thanks Alan, I opened up the inf folder, and, what do ya know, the .adm files were missing, so I downloaded them from MS and GPMC works fine now. As for my problem, I have enforced policies, such as disabling the change of password (these are semi-public machines) disabled MSI installer, set a desktop background that cannot be changed, disabled regedit, and the changing of the screensaver. It appears as though the policy is not getting applied to only the Windows 2000 machines in the network, the XP machines have everything working fine. We have tried doing a clean reinstall, to ensure that nothing is conflicting and even that machine is not enforcing the policy. I have tried using the forced gpupdate (different command in 2000) and that still did not enforce the policy. The UserENV.log from one of the XP machines (highlighted in pink) is below. The Windows 2000 (highlighted in green) follows it. I could not get the download going for the Policy Log Reporter, so I was unable to get it installed and working. The logs provided are, I am assuming, just of errors that happen and do not report the full process of the GPO. Thanks, Dustin Capital Area Chapter of the American Red Cross, Tallahassee, FL XP UserENV.log (note this is part of it, the full length would make this email go forever, the last error, continues for quite a long ways down the list) Hope this helps, at least part way: USERENV(294.298) 00:08:10:968 CUserProfile::CleanupUserProfile: Ref Count is not 0 USERENV(294.298) 00:08:11:000 CUserProfile::CleanupUserProfile: Ref Count is not 0 USERENV(294.298) 00:08:11:000 CUserProfile::CleanupUserProfile: Ref Count is not 0 USERENV(294.298) 00:08:11:000 CUserProfile::CleanupUserProfile: Ref Count is not 0 USERENV(2c0.2c4) 00:08:49:906 UnloadUserProfile: received a NULL hProfile. USERENV(294.48c) 00:08:54:078 GetGPOInfo: Local GPO's gpt.ini is not accessible, assuming default state. USERENV(294.198) 02:04:20:018 GetGPOInfo: Local GPO's gpt.ini is not accessible, assuming default state. USERENV(294.198) 03:55:19:733 GetGPOInfo: Local GPO's gpt.ini is not accessible, assuming default state. USERENV(294.198) 05:33:43:154 PingComputer: GetBestInterface with 1003 USERENV(294.198) 05:33:43:154 ProcessGPOs: DSGetDCName failed with 10065. USERENV(294.198 ) 07:13:43:185 PingComputer: GetBestInterface with 1003 USERENV(294.198) 07:13:43:185 ProcessGPOs: DSGetDCName failed with 10065. USERENV(294.198) 09:08:43:201 PingComputer: GetBestInterface with 1003 USERENV(294.198 ) 09:08:43:201 ProcessGPOs: DSGetDCName failed with 10065. USERENV(294.198) 10:49:38:788 GetGPOInfo: Local GPO's gpt.ini is not accessible, assuming default state. USERENV(294.198) 12:33:36:551 GetGPOInfo: Local GPO's gpt.ini is not accessible, assuming default state. USERENV(294.198) 14:11:29:105 GetGPOInfo: Local GPO's gpt.ini is not accessible, assuming default state. USERENV(294.198) 16:07:53:997 GetGPOInfo: Local GPO's gpt.ini is not accessible, assuming default state. Windows 2000UserENV.log (this is only part of the file, the last 4 or 5 lines repeat for quite a while down the list.) Hope this helps: USERENV(b8.2c0) 18:25:32:765 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.2c0) 18:25:37:802 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.2c0) 18:25:42:769 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.2c0) 18:25:47:736 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.2c0) 18:25:47:736 ProcessGPOs: MyGetUserName failed with 1722. USERENV(b8.a0) 19:38:11:062 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.a0) 19:38:16:990 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.a0) 19:38:19:914 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.a0) 19:38:24:701 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.a0) 19:38:24:701 GetUserGuid: Failed to get user guid with 1722. USERENV(b8.a0) 19:38:30:930 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.a0) 19:38:35:737 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.a0) 19:38:39:342 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.a0) 19:38:43:268 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.a0) 19:38:43:268 GetUserGuid: Failed to get user guid with 1722. USERENV(b8.1f8) 19:38:47:484 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.1f8) 19:38:50:308 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.1f8) 19:38:55:165 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.1f8) 19:38:58:019 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.1f8) 19:38:58:019 ProcessGPOs: MyGetUserName failed with 1722. USERENV(b8.1b8) 20:22:48:111 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.1b8) 20:22:48:782 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.1b8) 20:22:49:453 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.1b8) 20:22:50:124 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.1b8) 20:22:50:124 ProcessGPOs: MyGetUserName failed with 1722. USERENV(b8.c4) 21:27:58:354 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.c4) 21:27:59:025 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.c4) 21:27:59:696 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.c4) 21:28:00:367 MyGetUserName: GetUserNameEx failed with 1722. USERENV(b8.c4) 21:28:00:367 ProcessGPOs: MyGetUserName failed with 1722. On 2/27/07, Alan & Margaret <syspro@xxxxxxxxxxxxxxxx > wrote: Hi Dustin, Welcome to the world of Group Policy Management! It will both amaze and frustrate you! It does sound that you have a dodgy version of wuau.adm. Try opening the file using Notepad and see if it is a readable text file. Also open another one and see if it is a similar style. Having said that, ADM files play no part in applying policies. They are only used by GPMC when viewing Admin Template settings. Basically GPMC reads the Registry.Pol file (which contains all of the settings) and uses the ADM file to display it in a meaningful way. To fix that problem I think if you replace it with a correct version. You should be able to go to <http://www.microsoft.com/downloads/details.aspx?familyid=92759D4B-7112-4B6C -AD4A-BBF3802A5C9B&displaylang=en> http://www.microsoft.com/downloads/details.aspx?familyid=92759D4B-7112-4B6C- AD4A-BBF3802A5C9B&displaylang=en to get it. So, what is your real problem? Distribution of the GPO's is usually not a problem; it is more likely to be the application of the policy. You could try explaining exactly what is going wrong, or else you could dive in yourself and try to analyze the UserEnv.log that is written when processing Group Policy. The former is probably quicker but the latter is more fun and you will learn more! Unfortunately the log is a bit hard to read, but I have a free program that you can download and use (see below) . The first thing you have to do is activate logging (the program gives you a button to do this) then reboot the machine and view the log via my program. It shows all of the steps involved in Group Policy processing and may highlight the problem. You can always post the log up here and we can check it out for you. Best of luck Ps. You can also go to Darren's web site which has a lot of resources on Group Policies, but you probably know that already since you are in this News group. <http://www.gpoguy.com> www.gpoguy.com Alan Cuthbertson Policy Management Software:- http://www.sysprosoft.com/index.php?ref=activedir <http://www.sysprosoft.com/index.php?ref=activedir&f=pol_summary.shtml> &f=pol_summary.shtml ADM Template Editor:- http://www.sysprosoft.com/index.php?ref=activedir <http://www.sysprosoft.com/index.php?ref=activedir&f=adm_summary.shtml> &f=adm_summary.shtml Policy Log Reporter(Free) http://www.sysprosoft.com/index.php?ref=activedir <http://www.sysprosoft.com/index.php?ref=activedir&f=policyreporter.shtml> &f=policyreporter.shtml ________________________________ From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Dustin Hand Sent: Wednesday, 28 February 2007 6:51 AM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] GPO not getting distributed? Hi everyone, I am sort of a novice to Windows Server GPO. I have installed the GPMC because it seems like my GPO settings are not getting distributed, and the GPMC says that "'C:\WINDOWS\inf\wuau.adm' is not in a valid format, and it needs to be replaced." The error it says is that "A string is expected at line 0". This error appears under both sets of "Administrative Templates" in all GPOs Would this cause my GPO to not get distributed and applied? Regardless of if it is, how do I take care of this problem? Thanks in advance, Dustin -- Dustin Hand DustinHand@xxxxxxxxx -- Dustin Hand DustinHand@xxxxxxxxx -- Dustin Hand DustinHand@xxxxxxxxx