Intermittant GPO failure to apply
Windows Server Forum Index Windows Server
Server discussion on Windows platform.
 
 FAQFAQ   MemberlistMemberlist     RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 
 
Google
 
Web winserverhelp.com
Intermittant GPO failure to apply
Goto page 1, 2, 3  Next
 
Post new topic   Reply to topic    Windows Server Forum Index -> Small Business Server 2003
Author Message
NickC
Guest
Posted: Sat Jul 30, 2005 12:50 pm    Post subject: Intermittant GPO failure to apply Reply with quote
We have a problem on our workstations whereby around half of the time the
GPOs do not apply correctly but running 'GPUpdate /force' always temporarily
fixes the problem. Sometimes I can get all the workstations GPOs working
correctly then a few hours later they start failing without even rebooting!
Sometimes the machine boots and the GPOs are applied even before a user has
logged on, is that correct? When are GPOs supposed to be applied?

This manifests itself in Windows Firewall problems when the Firewall
settings Group Policy does not get applied correctly and the Firewall
reverts to its XPsp2 defaults. When that happens I find that the server
cannot remotely manage these workstations, in fact they can't even be
pinged.

Any suggestions on how I can diagnose this problem?

Nick
Back to top
Charles Yang [MSFT]
Guest
Posted: Mon Aug 01, 2005 8:51 am    Post subject: RE: Intermittant GPO failure to apply Reply with quote
Hi Nick,

Welcome to our SBS newsgroup.

Issue description:

==============

I understand that you encountered some problem that the GPO could not be
applied to Windows XP SP2 clients correctly.

Analyzing and suggestions:

===============

If you want have the Windows XP SP2 client computer in the SBS domain. This
issue occurs because Group Policy in Windows Small Business Server 2003
disables Windows Firewall for client computers that are running Windows XP
Professional. In order to solve the problem, please applied the hotfix for
Windows XP below:

872769 You cannot configure Windows Firewall settings or Security Center
http://support.microsoft.com/?id=872769

Please also apply the hotfix below to the SBS 2003:

842933 "The following entry in the [strings] section is too long and has
been
http://support.microsoft.com/?id=842933

================
If the issue still exists, please check the event view on SBS 2003, and
paste the error event to newsgroup, so that we can help you isolate the
issue more clearly.

More info:

873449 Changes to Group Policy behavior after installing Windows XP Service
http://support.microsoft.com/?id=873449

I appreciate your understanding if you have any further concerns; please
feel free to let me know. I am glad to be of any assistance.
Back to top
Charles Yang [MSFT]
Guest
Posted: Tue Aug 02, 2005 6:18 am    Post subject: Re: Intermittant GPO failure to apply Reply with quote
Hi Nick,

Thanks for updates.

Before we go any further, please also make sure that you have applied the
hotfix list in KB 872769, it did relate to policy on firewall setting on
Windows XP.

If so, if you create a new group policy on SBS 2003 domain, does the issue
still exist or not?

If the problem still exists, please follow the steps below to gather the
group policy log.

C:\Program Files\Microsoft Integration\Windows Small Business
2003\logs\setup.log.
C:\Program Files\Microsoft Integration\Windows Small Business
2003\logs\sbsmsi-gpmc.log

Please also refer to KB article below to enable this log files and
reproduce the issue then paste the log files:

221833 How to enable user environment debug logging in retail builds of
Windows
http://support.microsoft.com/?id=221833

You can send the log files to my mail box: v-chayan@microsoft.com


Thanks for your effort. I will be here waiting for your updates.
Back to top
NickC
Guest
Posted: Tue Aug 02, 2005 12:51 pm    Post subject: Re: Intermittant GPO failure to apply Reply with quote
Hi Charles,

With regard to Q872769 Microsoft state that the problem was fixed in XP
Service Pack 2; all these machines have always been SP2 they were all
installed from XP SP2 CDs.

I have emailed the setup.log & sbsmsi-gpmc.log to you as requested.

Below is a UserEnv.log from one of the workstations.

Nick

UserEnv.log:

USERENV(284.288) 13:08:51:703 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 13:08:51:703 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 13:08:51:703 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.780) 13:09:02:328 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.6e0) 13:09:49:425 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.1cc) 13:10:11:705 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 14:21:00:145 MyRegUnLoadKey: Failed to unmount hive
00000005
USERENV(284.288) 14:21:00:145 DumpOpenRegistryHandle: 2 user registry
Handles leaked from
\Registry\User\S-1-5-21-3513629081-3873135916-3088626867-1421
USERENV(284.288) 14:21:00:145 UnloadUserProfileP: Didn't unload user profile
<err = 5>
USERENV(284.288) 14:21:00:614 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(284.288) 14:21:00:614 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 14:21:04:333 UnloadUserProfile: UnloadUserProfileP failed
with 0
USERENV(284.288) 14:21:30:398 Profile was loaded but the Ref Count is 1 !!!
USERENV(284.e10) 14:21:31:617 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.e84) 14:21:35:055 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 14:22:50:140 UnloadUserProfileP: Didn't unload user profile
<err = 19>
USERENV(284.288) 14:22:50:468 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(284.288) 14:22:50:468 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 14:28:18:562 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 14:28:18:578 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 14:28:18:578 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.700) 14:28:27:843 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.684) 14:29:11:623 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.6d4) 14:29:13:801 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 14:31:57:204 MyRegUnLoadKey: Failed to unmount hive
00000005
USERENV(284.288) 14:31:57:204 DumpOpenRegistryHandle: 2 user registry
Handles leaked from
\Registry\User\S-1-5-21-3513629081-3873135916-3088626867-1421
USERENV(284.288) 14:31:57:204 UnloadUserProfileP: Didn't unload user profile
<err = 5>
USERENV(284.288) 14:31:57:517 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(284.288) 14:31:57:517 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 14:31:59:488 UnloadUserProfile: UnloadUserProfileP failed
with 0
USERENV(284.288) 14:33:03:218 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 14:33:03:218 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 14:33:03:218 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.710) 14:33:09:609 ProcessGPOs: GetNetworkName failed with 10091.
USERENV(284.710) 14:33:10:812 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.5a4) 14:33:23:376 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.5ec) 14:33:25:570 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 14:38:29:959 MyRegUnLoadKey: Failed to unmount hive
00000005
USERENV(284.288) 14:38:29:959 DumpOpenRegistryHandle: 2 user registry
Handles leaked from
\Registry\User\S-1-5-21-3513629081-3873135916-3088626867-1421
USERENV(284.288) 14:38:29:959 UnloadUserProfileP: Didn't unload user profile
<err = 5>
USERENV(284.288) 14:38:30:318 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(284.288) 14:38:30:318 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 14:38:32:799 UnloadUserProfile: UnloadUserProfileP failed
with 0
USERENV(284.288) 14:41:27:296 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 14:41:27:312 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 14:41:27:312 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.714) 14:41:35:031 ProcessGPOs: GetNetworkName failed with 10091.
USERENV(284.714) 14:41:36:140 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.4fc) 14:42:16:540 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.5a4) 14:42:17:544 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.4e0) 14:43:11:173 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.17c) 14:43:11:188 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.4e0) 14:43:11:674 ProcessGPOs: Forced option changed policy
mode.
USERENV(284.d7c) 14:44:06:338 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.e00) 14:44:28:636 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 15:04:48:328 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:04:48:328 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:04:48:328 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.708) 15:04:55:046 ProcessGPOs: GetNetworkName failed with 10091.
USERENV(284.708) 15:04:56:453 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.f0) 15:06:31:914 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.124) 15:06:32:651 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.128) 15:10:54:641 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.3b4) 15:10:54:641 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.128) 15:10:55:157 ProcessGPOs: Forced option changed policy
mode.
USERENV(284.790) 15:12:05:971 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.814) 15:12:08:599 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 15:12:39:164 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(284.288) 15:12:39:164 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 15:15:15:593 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:15:15:593 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:15:15:593 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.75c) 15:15:24:234 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.48c) 15:15:40:450 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.5e4) 15:16:03:311 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 15:25:04:203 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:25:04:218 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:25:04:218 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.7a4) 15:25:11:312 ProcessGPOs: GetNetworkName failed with 10091.
USERENV(284.7a4) 15:25:12:625 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.520) 15:25:26:496 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.520) 15:25:26:512 ReadMembershipList: Group
S-1-5-21-1715567821-1637723038-725345543-1005 not in current list of token
groups
USERENV(284.678) 15:25:48:914 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.6b8) 15:27:51:379 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.3f8) 15:27:51:395 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.6b8) 15:27:51:850 ProcessGPOs: Forced option changed policy
mode.
USERENV(284.288) 15:28:18:899 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\NJCauston\ntuser.pol>, error = 2
USERENV(284.288) 15:28:18:899 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 15:35:56:656 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:35:56:656 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:35:56:656 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.730) 15:36:05:093 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.288) 15:40:07:703 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:40:07:703 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:40:07:703 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.73c) 15:40:14:609 ProcessGPOs: GetNetworkName failed with 10091.
USERENV(284.73c) 15:40:16:328 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.5b0) 15:40:37:532 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.754) 15:40:58:730 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.758) 15:41:37:174 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.404) 15:41:37:205 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.758) 15:41:37:613 ProcessGPOs: Forced option changed policy
mode.
USERENV(284.288) 15:41:58:058 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\NJCauston\ntuser.pol>, error = 2
USERENV(284.288) 15:41:58:058 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 15:43:02:593 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:43:02:609 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 15:43:02:609 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.71c) 15:43:09:546 ProcessGPOs: GetNetworkName failed with 10091.
USERENV(284.71c) 15:43:10:781 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.52c) 15:43:27:929 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.6b4) 15:43:50:351 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.6b8) 15:44:39:512 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.3b4) 15:44:39:543 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.6b8) 15:44:39:951 ProcessGPOs: Forced option changed policy
mode.
USERENV(284.288) 15:45:00:143 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\NJCauston\ntuser.pol>, error = 2
USERENV(284.288) 15:45:00:143 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.b68) 15:45:25:925 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.b9c) 15:45:27:887 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 16:26:12:021 MyRegUnLoadKey: Failed to unmount hive
00000005
USERENV(284.288) 16:26:12:021 DumpOpenRegistryHandle: 2 user registry
Handles leaked from
\Registry\User\S-1-5-21-3513629081-3873135916-3088626867-1421
USERENV(284.288) 16:26:12:021 UnloadUserProfileP: Didn't unload user profile
<err = 5>
USERENV(284.288) 16:26:12:459 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(284.288) 16:26:12:459 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 16:26:14:301 UnloadUserProfile: UnloadUserProfileP failed
with 0
USERENV(284.288) 16:28:02:640 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 16:28:02:656 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 16:28:02:656 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.704) 16:28:11:781 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.138) 16:29:56:180 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.1b0) 16:29:56:730 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 16:39:49:388 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(284.288) 16:39:49:388 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 08:29:00:562 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 08:29:00:578 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.288) 08:29:00:578 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(284.71c) 08:29:11:046 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.4e4) 08:31:35:298 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.58c) 08:31:35:847 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 08:34:35:646 MyRegUnLoadKey: Failed to unmount hive
00000005
USERENV(284.288) 08:34:35:646 DumpOpenRegistryHandle: 2 user registry
Handles leaked from
\Registry\User\S-1-5-21-3513629081-3873135916-3088626867-1421
USERENV(284.288) 08:34:35:646 UnloadUserProfileP: Didn't unload user profile
<err = 5>
USERENV(284.288) 08:34:35:990 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(284.288) 08:34:35:990 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 08:34:38:025 UnloadUserProfile: UnloadUserProfileP failed
with 0
USERENV(284.288) 08:35:02:942 Profile was loaded but the Ref Count is 1 !!!
USERENV(284.d7c) 08:35:03:959 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.ddc) 08:35:07:199 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 08:35:38:737 UnloadUserProfileP: Didn't unload user profile
<err = 19>
USERENV(284.288) 08:35:39:066 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(284.288) 08:35:39:066 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.940) 08:38:06:580 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.470) 08:38:07:222 PolicyChangedThread: UpdateUser failed with 2.
USERENV(284.444) 10:14:22:676 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.148) 10:32:08:598 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.84c) 10:32:08:754 PolicyChangedThread: UpdateUser failed with 2.
USERENV(284.288) 11:12:50:050 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\NESmith\ntuser.pol>, error = 2
USERENV(284.288) 11:12:50:050 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 11:45:03:376 Profile was loaded but the Ref Count is 1 !!!
USERENV(284.c18) 11:45:04:892 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.f1c) 11:45:28:812 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 11:50:53:751 UnloadUserProfileP: Didn't unload user profile
<err = 19>
USERENV(284.288) 11:50:54:126 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(284.288) 11:50:54:126 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(284.288) 11:51:06:422 Profile was loaded but the Ref Count is 1 !!!
USERENV(284.d90) 11:51:07:562 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.834) 11:51:10:875 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.444) 11:52:28:149 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(c8c.c30) 12:01:56:364 DeleteProfileEx: Failed to query profile guid
with error 2
USERENV(c8c.c30) 12:01:56:504 DeleteProfile: Failed to delete the appmgmt
dir
C:\WINDOWS\system32\appmgmt\S-1-5-21-725345543-2147250837-1396137978-1009,
error 3
USERENV(c8c.c30) 12:02:03:285 DeleteProfileEx: Failed to query profile guid
with error 2
USERENV(c8c.c30) 12:02:03:394 DeleteProfile: Failed to delete the appmgmt
dir
C:\WINDOWS\system32\appmgmt\S-1-5-21-725345543-2147250837-1396137978-1004,
error 3
USERENV(c8c.c30) 12:02:11:191 DeleteProfileEx: Failed to query profile guid
with error 2
USERENV(c8c.c30) 12:02:11:315 DeleteProfile: Failed to delete the appmgmt
dir
C:\WINDOWS\system32\appmgmt\S-1-5-21-725345543-2147250837-1396137978-1006,
error 3
USERENV(c8c.c30) 12:02:15:003 DeleteProfileEx: Failed to query profile guid
with error 2
USERENV(c8c.c30) 12:02:15:268 DeleteProfile: Failed to delete the appmgmt
dir
C:\WINDOWS\system32\appmgmt\S-1-5-21-725345543-2147250837-1396137978-1003,
error 3
USERENV(c8c.c30) 12:02:22:268 DeleteProfile: Failed to delete the appmgmt
dir
C:\WINDOWS\system32\appmgmt\S-1-5-21-3513629081-3873135916-3088626867-1141,
error 3
USERENV(c8c.c30) 12:02:28:205 DeleteProfile: Failed to delete the appmgmt
dir
C:\WINDOWS\system32\appmgmt\S-1-5-21-3513629081-3873135916-3088626867-1140,
error 3
USERENV(c8c.c30) 12:02:31:642 DeleteProfile: Failed to delete the appmgmt
dir
C:\WINDOWS\system32\appmgmt\S-1-5-21-3513629081-3873135916-3088626867-1143,
error 3
USERENV(c8c.c30) 12:02:40:672 DeleteProfile: Failed to delete the appmgmt
dir
C:\WINDOWS\system32\appmgmt\S-1-5-21-3513629081-3873135916-3088626867-500,
error 3
USERENV(284.bdc) 13:22:11:867 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.cd0) 13:22:12:086 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.444) 13:28:34:598 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.444) 15:06:40:920 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.bdc) 15:07:12:342 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(284.688) 15:07:12:607 PolicyChangedThread: UpdateUser failed with 6.
USERENV(284.288) 16:37:06:806 UnloadUserProfileP: Didn't unload user profile
<err = 19>
USERENV(284.288) 16:37:07:134 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(284.288) 16:37:07:134 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(27c.280) 08:20:03:140 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(27c.280) 08:20:03:140 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(27c.280) 08:20:03:140 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(27c.724) 08:20:15:906 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.6bc) 08:20:34:170 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.25c) 08:20:56:909 PolicyChangedThread: UpdateUser failed with 6.
USERENV(27c.464) 10:01:29:502 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.268) 10:13:59:319 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.fe4) 10:13:59:569 PolicyChangedThread: UpdateUser failed with 6.
USERENV(27c.464) 11:43:35:686 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.268) 12:08:00:320 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.984) 12:08:00:539 PolicyChangedThread: UpdateUser failed with 6.
USERENV(27c.464) 13:42:41:719 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.268) 14:04:01:127 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.d90) 14:04:01:345 PolicyChangedThread: UpdateUser failed with 6.
USERENV(27c.464) 15:24:47:758 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.280) 15:54:14:346 MyRegUnLoadKey: Failed to unmount hive
00000005
USERENV(27c.280) 15:54:14:346 DumpOpenRegistryHandle: 2 user registry
Handles leaked from
\Registry\User\S-1-5-21-3513629081-3873135916-3088626867-1421
USERENV(27c.280) 15:54:14:346 UnloadUserProfileP: Didn't unload user profile
<err = 5>
USERENV(27c.280) 15:54:14:768 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(27c.280) 15:54:14:768 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(27c.280) 15:54:19:346 UnloadUserProfile: UnloadUserProfileP failed
with 0
USERENV(27c.280) 08:29:25:015 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(27c.280) 08:29:25:015 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(27c.280) 08:29:25:015 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(27c.734) 08:29:40:328 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.cc) 08:30:24:529 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.148) 08:30:25:640 PolicyChangedThread: UpdateUser failed with 6.
USERENV(27c.458) 10:00:56:695 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.14c) 10:26:33:143 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(27c.a5c) 10:26:33:924 PolicyChangedThread: UpdateUser failed with 6.



""Charles Yang [MSFT]"" <v-chayan@online.microsoft.com> wrote in message
news:lF03VAwlFHA.3672@TK2MSFTNGXA01.phx.gbl...
[quote]Hi Nick,

Thanks for updates.

Before we go any further, please also make sure that you have applied the
hotfix list in KB 872769, it did relate to policy on firewall setting on
Windows XP.

If so, if you create a new group policy on SBS 2003 domain, does the issue
still exist or not?

If the problem still exists, please follow the steps below to gather the
group policy log.

C:\Program Files\Microsoft Integration\Windows Small Business
2003\logs\setup.log.
C:\Program Files\Microsoft Integration\Windows Small Business
2003\logs\sbsmsi-gpmc.log

Please also refer to KB article below to enable this log files and
reproduce the issue then paste the log files:

221833 How to enable user environment debug logging in retail builds of
Windows
http://support.microsoft.com/?id=221833

You can send the log files to my mail box: v-chayan@microsoft.com


Thanks for your effort. I will be here waiting for your updates.
Back to top
Charles Yang [MSFT]
Guest
Posted: Wed Aug 03, 2005 6:28 am    Post subject: Re: Intermittant GPO failure to apply Reply with quote
Hi Nick,

I am sorry for not clear this issue to you, this hotfix is mainly for the
clients OS which is already SP2, it is a special updates after SP2, it is
not included in SP2, so please kindly apply that updates to see if the
firewall setting is still revert to default setting.

Meanwhile I will perform more deep research on this issue.


Thanks for your updates.
Back to top
Charles Yang [MSFT]
Guest
Posted: Thu Aug 04, 2005 12:50 pm    Post subject: Re: Intermittant GPO failure to apply Reply with quote
Just some updates,

From your log, I found that you could not access the gp.ini, it might be
permission issue, please make sure that the permission of the sysvol on
your SBS is set correctly.

Thanks for your understanding.

Best regards,

Charles Yang (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security
Back to top
NickC
Guest
Posted: Thu Aug 04, 2005 12:51 pm    Post subject: Re: Intermittant GPO failure to apply Reply with quote
Hi Charles,

Thank you fore your suggestions.

Here is a smaller UserEnv.log I took from workstation yesterday at a time
when the GPO failed to apply:

USERENV(28c.290) 11:20:00:610 SetNtUserPolTime: couldn't get file
attributes <C:\Documents and Settings\<username>\ntuser.pol>, error = 2
USERENV(28c.290) 11:20:00:610 UnloadUserProfile: Failed to SetNtUserPolTime,
hr = 80070002
USERENV(28c.290) 11:20:38:234 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(28c.290) 11:20:38:234 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(28c.290) 11:20:38:234 CUserProfile::CleanupUserProfile: Ref Count is
not 0
USERENV(28c.73c) 11:20:44:000 ProcessGPOs: GetNetworkName failed with 10091.
USERENV(28c.73c) 11:20:44:968 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(28c.500) 11:20:53:093 GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.
USERENV(28c.520) 11:20:53:750 PolicyChangedThread: UpdateUser failed with 6.

Any idea of the relevance of the 'Local GPO's gpt.ini is not accessible'
does this indicate that the system is looking for a Local gpt.ini, if so
where is it looking?

Don't know if relevant but I have noticed the following event log error:
Event Type: Warning
Event Source: Userenv
Event Category: None
Event ID: 1517
Date: 03/08/2005, Time: 15:44:11
User: NT AUTHORITY\SYSTEM
Computer: Workstation2
Description:
Windows saved user SKANREG\<username> registry while an application or
service was still using the registry during log off. The memory used by the
user's registry has not been freed. The registry will be unloaded when it is
no longer in use.
This is often caused by services running as a user account, try configuring
the services to run in either the LocalService or NetworkService account.


SysVol share permissions are:
Administrators & Authenticated Users: Full control
Everyone: Read

Sysvol {invidual policy} directory Security permissions are Not inherited
from parent:
Authenticated Users: Read & execute, List folder contents, Read
Creator owner: None
Domain Admins: Full control
Enterprise Admins: Full control
Enterprise Domain controllers: Read & execute, List folder contents, Read
System: Full control

Every time I have tested access to the Sysvol\Policies\...GPT.ini files from
a GPO failed workstation the GPO.ini has been readable.

Regards,
Nick
Back to top
Games and SBS 2003
Guest
Posted: Thu Aug 18, 2005 8:51 am    Post subject: Re: Intermittant GPO failure to apply Reply with quote
Hi,
I seem to having a similar problem with my gpo settings. how do you check
the permissions of the sysvol ?
Back to top
NickC
Guest
Posted: Thu Aug 18, 2005 12:51 pm    Post subject: Re: Intermittant GPO failure to apply Reply with quote
\\yourDomain.local\Sysvol\yourDomain.local\Policies - properties - security
tab
see my previous email for the permissions our server has.

Nick
Back to top
echobob
Guest
Posted: Fri Aug 19, 2005 8:51 pm    Post subject: RE: Intermittant GPO failure to apply Reply with quote
Nick,

I'm not sure if these will run under sbs, but I went through the same type
of trouble a while back under 2k server. The tools I used were gpotools,
frsdiag,sonar, and dcdiag available from microsoft. My problems were flaky
DNS from an abandoned server, and sysvol shares pointing to a different drive
in the registry.

Each one showed me a different piece of the puzzle..


"NickC" wrote:

Quote:
We have a problem on our workstations whereby around half of the time the
GPOs do not apply correctly but running 'GPUpdate /force' always temporarily
fixes the problem. Sometimes I can get all the workstations GPOs working
correctly then a few hours later they start failing without even rebooting!
Sometimes the machine boots and the GPOs are applied even before a user has
logged on, is that correct? When are GPOs supposed to be applied?

This manifests itself in Windows Firewall problems when the Firewall
settings Group Policy does not get applied correctly and the Firewall
reverts to its XPsp2 defaults. When that happens I find that the server
cannot remotely manage these workstations, in fact they can't even be
pinged.

Any suggestions on how I can diagnose this problem?

Nick


Back to top
NickC
Guest
Posted: Mon Aug 22, 2005 12:51 pm    Post subject: Re: Intermittant GPO failure to apply Reply with quote
Hi Charles,

UPHClean now installed and logging the following errors:

Event Type: Information

Event Source: UPHClean

Event Category: None

Event ID: 1501

Date: 18/08/2005

Time: 16:32:11

User: <DOMAINNAME>\<username>

Computer: <DOMAINNAME>5

Description:

The following handles opened in user profile hive <DOMAINNAME>\<username>
(S-1-5-21-3513629081-3873135916-3088626867-1364) are preventing the profile
from unloading:

svchost.exe (888)

HKCU (0x3a0)

How can I tell what application is causing this?

Thanks,
Nick
Back to top
Charles Yang [MSFT]
Guest
Posted: Tue Aug 23, 2005 8:51 am    Post subject: Re: Intermittant GPO failure to apply Reply with quote
Hi,

Thanks for updates.

From the information you gave to me, we can not identify the root cause,
have you try my suggestion in my last reply, I would like to paste them
again:


FYI:

What I means about Trend is to disable it on the client computer if you
have also deploy it on client computer, as I know there is some problem on
this software if you deploy it on client computer.

As this is an intermittent issue, so it might need some time to
troubleshoot. in my previous reply, I suggest you disable all the SMB
signing on both client computer and server, please also make sure that you
have disable all the SMB signing on the group policy. You can refer to the
article below to disable it.

Please refer to the following link to disable the SMB signing to see if the
slow network access issue will be resolved:
http://www.smallbizserver.net/Default.aspx?tabid=98

I appreciate your effort on this issue.



Best regards,

Charles Yang (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
Back to top
NickC
Guest
Posted: Thu Aug 25, 2005 4:51 pm    Post subject: Re: Intermittant GPO failure to apply Reply with quote
Hi Charles,

Disabling the rename administrator account GPO and others didn't seem to
help so have now re-enabled them.

All SMB signing GPO settings are now set to disabled so will wait and see
what effect that has (must remember to reboot the server a few times).

Workstations do indeed have Trend Micro CSM for SMB remotely installed and
updating from the SBS server. Problem is these workstations are all live so
I cannot safely leave virus checking disabled. Do you have any more
information about this possible Trend Micro problem?

UPHClean is installed and reports the following error but I can't see how to
identify which application is actually causing this:
The following handles opened in user profile hive <DOMAINNAME>\<username>
(S-1-5-21-3513629081-3873135916-3088626867-1364) are preventing the profile
from unloading:
svchost.exe (888)
HKCU (0x3a0)


Regards,
Nick



Hi,

Thanks for updates.

From the information you gave to me, we can not identify the root cause,
have you try my suggestion in my last reply, I would like to paste them
again:


FYI:

What I means about Trend is to disable it on the client computer if you
have also deploy it on client computer, as I know there is some problem on
this software if you deploy it on client computer.

As this is an intermittent issue, so it might need some time to
troubleshoot. in my previous reply, I suggest you disable all the SMB
signing on both client computer and server, please also make sure that you
have disable all the SMB signing on the group policy. You can refer to the
article below to disable it.

Please refer to the following link to disable the SMB signing to see if the
slow network access issue will be resolved:
http://www.smallbizserver.net/Default.aspx?tabid=98

I appreciate your effort on this issue.



Best regards,

Charles Yang (MSFT)
Back to top
Charles Yang [MSFT]
Guest
Posted: Fri Aug 26, 2005 6:46 am    Post subject: Re: Intermittant GPO failure to apply Reply with quote
Hi Nick,

Thanks for updates.

I will waiting for your results, as I mentioned we could not troubleshoot
the root cause of this problem via newsgroup, it might be a complex
problem, as I referred many factors might blocked the GPO updates, firewall
anti-virus software or SMB signing.

Sorry for inconvenience, and thanks for your efforts.



Best regards,

Charles Yang (MSFT)

Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

======================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.


=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
Back to top
NickC
Guest
Posted: Fri Aug 26, 2005 12:50 pm    Post subject: Re: Intermittant GPO failure to apply Reply with quote
Charles,

What about the UserEnv errors: 'GetGPOInfo: Local GPO's gpt.ini is not
accessible, assuming default state.' do these actually indicate real GPO
errors or does everyone get these?

Also what about the UPHClean errors how do I determine what is causing
these?

Thanks,
Nick
Back to top
 
Post new topic   Reply to topic    Windows Server Forum Index -> Small Business Server 2003 All times are GMT
Goto page 1, 2, 3  Next
Page 1 of 3

 
 You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum




New Topics Powered by phpBB