| Author |
Message |
Glenn L
Guest
|
 Posted:
Thu Nov 11, 2004 2:56 am Post subject:
group policy fails with userenv 1030,158 |
|
|
Layout
site 1)DC01, member01
site 2)DC02
site 3)DC03
All W2K3 server
I'm testing member01's ability to failover to another DC for group policy
application in the event DC01 fails.
I verify member01 applies GPO sucessfully from DC01.
I pull the network tap on DC01 and force gpupdate on member01. It
successfully applies GPOs. (in other words it failed over to another sysvol
based on its existing DFS referral table)
If I reboot member01 or manually purge the DFS referral cache, GPO
application fails with 1030 & 1058 "the specified file cannot be found" for
the GPT.ini file.
The network trace shows the DFS referral to the client ordered with DC01 at
the top of the list.
Member01 sends out arp requests for DC01 until it times out. It does not
attempt to failover to another sysvol location. I thought it was suppose to
failover.
My question.
Should the client attempt to failover to another sysvol copy? (I would
think so)
Should the DFS server detect DC01 offline and not include it in the DFS
referral to the client?
--
Glenn L
CCNA, MCSE (2000,2003) + Security |
|
| Back to top |
|
 |
Mark Renoden [MSFT]
Guest
|
| Posted:
Thu Nov 11, 2004 3:24 am Post subject:
Re: group policy fails with userenv 1030,158 |
|
|
Hi Glenn
There's a hotfix for 1030 / 1058 events ...
842804 Group Policy processing does not work and events 1030 and 1058 are
http://support.microsoft.com/?id=842804
If this doesn't resolve the issue, I'd suggest logging a support incident.
I've seen a few instances of this issue and there's a long and involved
checklist of items that need to be worked through and verified.
If you look for ealier posts from me, I think I've provided a reasonably
comprehensive list but I'm not certain this is everything.
Try the hotfix first and go from there I guess.
HTH
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OoIzTc2xEHA.1404@TK2MSFTNGP11.phx.gbl...
| Quote: | Layout
site 1)DC01, member01
site 2)DC02
site 3)DC03
All W2K3 server
I'm testing member01's ability to failover to another DC for group policy
application in the event DC01 fails.
I verify member01 applies GPO sucessfully from DC01.
I pull the network tap on DC01 and force gpupdate on member01. It
successfully applies GPOs. (in other words it failed over to another
sysvol based on its existing DFS referral table)
If I reboot member01 or manually purge the DFS referral cache, GPO
application fails with 1030 & 1058 "the specified file cannot be found"
for the GPT.ini file.
The network trace shows the DFS referral to the client ordered with DC01
at the top of the list.
Member01 sends out arp requests for DC01 until it times out. It does not
attempt to failover to another sysvol location. I thought it was suppose
to failover.
My question.
Should the client attempt to failover to another sysvol copy? (I would
think so)
Should the DFS server detect DC01 offline and not include it in the DFS
referral to the client?
--
Glenn L
CCNA, MCSE (2000,2003) + Security
|
|
|
| Back to top |
|
|
Glenn L
Guest
|
| Posted:
Thu Nov 11, 2004 5:28 am Post subject:
Re: group policy fails with userenv 1030,158 |
|
|
Thanks Mark.
I am aware of the long comprehensive list of things to check for. I'll
admit I have not gone through the list.
I'm not convinced there is anything on it that will help. This is a very
specific thing that only breaks GPO processing when I pull the plug on the
DC. I plug the NIC back in and all is well.
I also tested the same thing using an XP client and it also fails in the
same way.
After rebooting client, and with DC01 plugged in, the client XP or W2K3 will
apply GPO successfully.
dfsreferral cache shows DC01 as the active DFSLINK. This is to be expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749248 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
1:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I unplug DC01 from the network, force a GPO update on the client, and it
(WinXP or W2K3) successfully fails over to an alternate DFS link and applies
GPO successfully. Now the dfsreferral cache shows DC03 as the active node.
This failover is expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC03.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I then purge the dfsreferral cache (dfsutil /pktflush) This is the same as a
reboot in this context. We see 0 entries.
--mup.sys--
0 entries...
I then force a GPO update on the client. The DFSreferral is the same with
DC01 at the top of the list. The client fails to apply the GPO (XP or
W2K3). It generates a 1030,1058 combination indicating "The system cannot
find the file specified". A network trace shows the client attempting to
contact DC01 by arping for it (it continues to arp for DC01 and makes no
attempt to contact DC02 or DC03(. But the client never fails over to an
alternate DFS link. Note: the DFS referral table shows nothing as active.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
I would expect the client to fail over to an alternate link, but this is not
happening.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:efLH3u2xEHA.3368@TK2MSFTNGP15.phx.gbl...
| Quote: | Hi Glenn
There's a hotfix for 1030 / 1058 events ...
842804 Group Policy processing does not work and events 1030 and 1058 are
http://support.microsoft.com/?id=842804
If this doesn't resolve the issue, I'd suggest logging a support incident.
I've seen a few instances of this issue and there's a long and involved
checklist of items that need to be worked through and verified.
If you look for ealier posts from me, I think I've provided a reasonably
comprehensive list but I'm not certain this is everything.
Try the hotfix first and go from there I guess.
HTH
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OoIzTc2xEHA.1404@TK2MSFTNGP11.phx.gbl...
Layout
site 1)DC01, member01
site 2)DC02
site 3)DC03
All W2K3 server
I'm testing member01's ability to failover to another DC for group policy
application in the event DC01 fails.
I verify member01 applies GPO sucessfully from DC01.
I pull the network tap on DC01 and force gpupdate on member01. It
successfully applies GPOs. (in other words it failed over to another
sysvol based on its existing DFS referral table)
If I reboot member01 or manually purge the DFS referral cache, GPO
application fails with 1030 & 1058 "the specified file cannot be found"
for the GPT.ini file.
The network trace shows the DFS referral to the client ordered with DC01
at the top of the list.
Member01 sends out arp requests for DC01 until it times out. It does not
attempt to failover to another sysvol location. I thought it was suppose
to failover.
My question.
Should the client attempt to failover to another sysvol copy? (I would
think so)
Should the DFS server detect DC01 offline and not include it in the DFS
referral to the client?
--
Glenn L
CCNA, MCSE (2000,2003) + Security
|
|
|
| Back to top |
|
|
Mark Renoden [MSFT]
Guest
|
| Posted:
Thu Nov 11, 2004 6:59 am Post subject:
Re: group policy fails with userenv 1030,158 |
|
|
Hi Glenn
I had a small part to play in the case that motivated this hotfix. I just
spoke to the guy who authored the article I pointed to before and he
suggested it will probably be of assistance in your case.
If it doesn't help and you can't reproduce the behaviour on a Windows 2000
client, it's probably worth contacting Microsoft to have it investigated.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:ugdsVx3xEHA.4028@TK2MSFTNGP09.phx.gbl...
| Quote: | Thanks Mark.
I am aware of the long comprehensive list of things to check for. I'll
admit I have not gone through the list.
I'm not convinced there is anything on it that will help. This is a very
specific thing that only breaks GPO processing when I pull the plug on the
DC. I plug the NIC back in and all is well.
I also tested the same thing using an XP client and it also fails in the
same way.
After rebooting client, and with DC01 plugged in, the client XP or W2K3
will apply GPO successfully.
dfsreferral cache shows DC01 as the active DFSLINK. This is to be
expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749248 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
1:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I unplug DC01 from the network, force a GPO update on the client, and it
(WinXP or W2K3) successfully fails over to an alternate DFS link and
applies GPO successfully. Now the dfsreferral cache shows DC03 as the
active node. This failover is expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC03.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I then purge the dfsreferral cache (dfsutil /pktflush) This is the same as
a reboot in this context. We see 0 entries.
--mup.sys--
0 entries...
I then force a GPO update on the client. The DFSreferral is the same with
DC01 at the top of the list. The client fails to apply the GPO (XP or
W2K3). It generates a 1030,1058 combination indicating "The system cannot
find the file specified". A network trace shows the client attempting to
contact DC01 by arping for it (it continues to arp for DC01 and makes no
attempt to contact DC02 or DC03(. But the client never fails over to an
alternate DFS link. Note: the DFS referral table shows nothing as active.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
I would expect the client to fail over to an alternate link, but this is
not happening.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:efLH3u2xEHA.3368@TK2MSFTNGP15.phx.gbl...
Hi Glenn
There's a hotfix for 1030 / 1058 events ...
842804 Group Policy processing does not work and events 1030 and 1058 are
http://support.microsoft.com/?id=842804
If this doesn't resolve the issue, I'd suggest logging a support
incident. I've seen a few instances of this issue and there's a long and
involved checklist of items that need to be worked through and verified.
If you look for ealier posts from me, I think I've provided a reasonably
comprehensive list but I'm not certain this is everything.
Try the hotfix first and go from there I guess.
HTH
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OoIzTc2xEHA.1404@TK2MSFTNGP11.phx.gbl...
Layout
site 1)DC01, member01
site 2)DC02
site 3)DC03
All W2K3 server
I'm testing member01's ability to failover to another DC for group
policy application in the event DC01 fails.
I verify member01 applies GPO sucessfully from DC01.
I pull the network tap on DC01 and force gpupdate on member01. It
successfully applies GPOs. (in other words it failed over to another
sysvol based on its existing DFS referral table)
If I reboot member01 or manually purge the DFS referral cache, GPO
application fails with 1030 & 1058 "the specified file cannot be found"
for the GPT.ini file.
The network trace shows the DFS referral to the client ordered with DC01
at the top of the list.
Member01 sends out arp requests for DC01 until it times out. It does
not attempt to failover to another sysvol location. I thought it was
suppose to failover.
My question.
Should the client attempt to failover to another sysvol copy? (I would
think so)
Should the DFS server detect DC01 offline and not include it in the DFS
referral to the client?
--
Glenn L
CCNA, MCSE (2000,2003) + Security
|
|
|
| Back to top |
|
|
Glenn L
Guest
|
| Posted:
Sat Nov 13, 2004 4:45 am Post subject:
Re: group policy fails with userenv 1030,158 |
|
|
I installed the hotfix, and it unfortunately had no impact.
It is possible this issue could be isolated to the VM environment I have
been testing in.
However, I suspect this behavior is reproducable on physical machines as
well.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:%23sCCtm4xEHA.4044@tk2msftngp13.phx.gbl...
| Quote: | Hi Glenn
I had a small part to play in the case that motivated this hotfix. I just
spoke to the guy who authored the article I pointed to before and he
suggested it will probably be of assistance in your case.
If it doesn't help and you can't reproduce the behaviour on a Windows 2000
client, it's probably worth contacting Microsoft to have it investigated.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:ugdsVx3xEHA.4028@TK2MSFTNGP09.phx.gbl...
Thanks Mark.
I am aware of the long comprehensive list of things to check for. I'll
admit I have not gone through the list.
I'm not convinced there is anything on it that will help. This is a very
specific thing that only breaks GPO processing when I pull the plug on
the DC. I plug the NIC back in and all is well.
I also tested the same thing using an XP client and it also fails in the
same way.
After rebooting client, and with DC01 plugged in, the client XP or W2K3
will apply GPO successfully.
dfsreferral cache shows DC01 as the active DFSLINK. This is to be
expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749248 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
1:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I unplug DC01 from the network, force a GPO update on the client, and it
(WinXP or W2K3) successfully fails over to an alternate DFS link and
applies GPO successfully. Now the dfsreferral cache shows DC03 as the
active node. This failover is expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC03.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I then purge the dfsreferral cache (dfsutil /pktflush) This is the same
as a reboot in this context. We see 0 entries.
--mup.sys--
0 entries...
I then force a GPO update on the client. The DFSreferral is the same
with DC01 at the top of the list. The client fails to apply the GPO (XP
or W2K3). It generates a 1030,1058 combination indicating "The system
cannot find the file specified". A network trace shows the client
attempting to contact DC01 by arping for it (it continues to arp for DC01
and makes no attempt to contact DC02 or DC03(. But the client never
fails over to an alternate DFS link. Note: the DFS referral table shows
nothing as active.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
I would expect the client to fail over to an alternate link, but this is
not happening.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:efLH3u2xEHA.3368@TK2MSFTNGP15.phx.gbl...
Hi Glenn
There's a hotfix for 1030 / 1058 events ...
842804 Group Policy processing does not work and events 1030 and 1058
are
http://support.microsoft.com/?id=842804
If this doesn't resolve the issue, I'd suggest logging a support
incident. I've seen a few instances of this issue and there's a long and
involved checklist of items that need to be worked through and verified.
If you look for ealier posts from me, I think I've provided a reasonably
comprehensive list but I'm not certain this is everything.
Try the hotfix first and go from there I guess.
HTH
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to
email me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OoIzTc2xEHA.1404@TK2MSFTNGP11.phx.gbl...
Layout
site 1)DC01, member01
site 2)DC02
site 3)DC03
All W2K3 server
I'm testing member01's ability to failover to another DC for group
policy application in the event DC01 fails.
I verify member01 applies GPO sucessfully from DC01.
I pull the network tap on DC01 and force gpupdate on member01. It
successfully applies GPOs. (in other words it failed over to another
sysvol based on its existing DFS referral table)
If I reboot member01 or manually purge the DFS referral cache, GPO
application fails with 1030 & 1058 "the specified file cannot be found"
for the GPT.ini file.
The network trace shows the DFS referral to the client ordered with
DC01 at the top of the list.
Member01 sends out arp requests for DC01 until it times out. It does
not attempt to failover to another sysvol location. I thought it was
suppose to failover.
My question.
Should the client attempt to failover to another sysvol copy? (I would
think so)
Should the DFS server detect DC01 offline and not include it in the DFS
referral to the client?
--
Glenn L
CCNA, MCSE (2000,2003) + Security
|
|
|
| Back to top |
|
|
Mark Renoden [MSFT]
Guest
|
| Posted:
Mon Nov 15, 2004 2:57 am Post subject:
Re: group policy fails with userenv 1030,158 |
|
|
Hi Glenn
It would be interesting to know if this was a virtual machine specific
problem. I have seen strange things happen with virtual networks in the
past. I'd be interested to see a network trace of this however:
1. Start capture.
2. Clear client cache.
3. Reproduce behaviour.
4. Stop capture.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OU291iQyEHA.3844@TK2MSFTNGP12.phx.gbl...
| Quote: | I installed the hotfix, and it unfortunately had no impact.
It is possible this issue could be isolated to the VM environment I have
been testing in.
However, I suspect this behavior is reproducable on physical machines as
well.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:%23sCCtm4xEHA.4044@tk2msftngp13.phx.gbl...
Hi Glenn
I had a small part to play in the case that motivated this hotfix. I
just spoke to the guy who authored the article I pointed to before and he
suggested it will probably be of assistance in your case.
If it doesn't help and you can't reproduce the behaviour on a Windows
2000 client, it's probably worth contacting Microsoft to have it
investigated.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:ugdsVx3xEHA.4028@TK2MSFTNGP09.phx.gbl...
Thanks Mark.
I am aware of the long comprehensive list of things to check for. I'll
admit I have not gone through the list.
I'm not convinced there is anything on it that will help. This is a
very specific thing that only breaks GPO processing when I pull the plug
on the DC. I plug the NIC back in and all is well.
I also tested the same thing using an XP client and it also fails in the
same way.
After rebooting client, and with DC01 plugged in, the client XP or W2K3
will apply GPO successfully.
dfsreferral cache shows DC01 as the active DFSLINK. This is to be
expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749248 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
1:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I unplug DC01 from the network, force a GPO update on the client, and
it (WinXP or W2K3) successfully fails over to an alternate DFS link and
applies GPO successfully. Now the dfsreferral cache shows DC03 as the
active node. This failover is expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC03.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I then purge the dfsreferral cache (dfsutil /pktflush) This is the same
as a reboot in this context. We see 0 entries.
--mup.sys--
0 entries...
I then force a GPO update on the client. The DFSreferral is the same
with DC01 at the top of the list. The client fails to apply the GPO (XP
or W2K3). It generates a 1030,1058 combination indicating "The system
cannot find the file specified". A network trace shows the client
attempting to contact DC01 by arping for it (it continues to arp for
DC01 and makes no attempt to contact DC02 or DC03(. But the client
never fails over to an alternate DFS link. Note: the DFS referral table
shows nothing as active.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
I would expect the client to fail over to an alternate link, but this is
not happening.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:efLH3u2xEHA.3368@TK2MSFTNGP15.phx.gbl...
Hi Glenn
There's a hotfix for 1030 / 1058 events ...
842804 Group Policy processing does not work and events 1030 and 1058
are
http://support.microsoft.com/?id=842804
If this doesn't resolve the issue, I'd suggest logging a support
incident. I've seen a few instances of this issue and there's a long
and involved checklist of items that need to be worked through and
verified.
If you look for ealier posts from me, I think I've provided a
reasonably comprehensive list but I'm not certain this is everything.
Try the hotfix first and go from there I guess.
HTH
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to
email me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OoIzTc2xEHA.1404@TK2MSFTNGP11.phx.gbl...
Layout
site 1)DC01, member01
site 2)DC02
site 3)DC03
All W2K3 server
I'm testing member01's ability to failover to another DC for group
policy application in the event DC01 fails.
I verify member01 applies GPO sucessfully from DC01.
I pull the network tap on DC01 and force gpupdate on member01. It
successfully applies GPOs. (in other words it failed over to another
sysvol based on its existing DFS referral table)
If I reboot member01 or manually purge the DFS referral cache, GPO
application fails with 1030 & 1058 "the specified file cannot be
found" for the GPT.ini file.
The network trace shows the DFS referral to the client ordered with
DC01 at the top of the list.
Member01 sends out arp requests for DC01 until it times out. It does
not attempt to failover to another sysvol location. I thought it was
suppose to failover.
My question.
Should the client attempt to failover to another sysvol copy? (I
would think so)
Should the DFS server detect DC01 offline and not include it in the
DFS referral to the client?
--
Glenn L
CCNA, MCSE (2000,2003) + Security
|
|
|
| Back to top |
|
|
Mark Renoden [MSFT]
Guest
|
| Posted:
Mon Nov 15, 2004 6:57 am Post subject:
Re: group policy fails with userenv 1030,158 |
|
|
Hi Glenn
I just had a crack and reproducing the behaviour without using sites and
didn't see what you're describing. I'm wondering if this might be related
to the /INSITE switch. Take a look at:
282071 Users Are Accessing a DFS Root Replica in a Remote Site
http://support.microsoft.com/?id=282071
It's been a while since I worked on a DFS case involving /INSITE but I have
a vague memory that if INSITE is set and the only DFS root replicate in the
site goes down, clients will have problems.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OU291iQyEHA.3844@TK2MSFTNGP12.phx.gbl...
| Quote: | I installed the hotfix, and it unfortunately had no impact.
It is possible this issue could be isolated to the VM environment I have
been testing in.
However, I suspect this behavior is reproducable on physical machines as
well.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:%23sCCtm4xEHA.4044@tk2msftngp13.phx.gbl...
Hi Glenn
I had a small part to play in the case that motivated this hotfix. I
just spoke to the guy who authored the article I pointed to before and he
suggested it will probably be of assistance in your case.
If it doesn't help and you can't reproduce the behaviour on a Windows
2000 client, it's probably worth contacting Microsoft to have it
investigated.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:ugdsVx3xEHA.4028@TK2MSFTNGP09.phx.gbl...
Thanks Mark.
I am aware of the long comprehensive list of things to check for. I'll
admit I have not gone through the list.
I'm not convinced there is anything on it that will help. This is a
very specific thing that only breaks GPO processing when I pull the plug
on the DC. I plug the NIC back in and all is well.
I also tested the same thing using an XP client and it also fails in the
same way.
After rebooting client, and with DC01 plugged in, the client XP or W2K3
will apply GPO successfully.
dfsreferral cache shows DC01 as the active DFSLINK. This is to be
expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749248 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
1:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I unplug DC01 from the network, force a GPO update on the client, and
it (WinXP or W2K3) successfully fails over to an alternate DFS link and
applies GPO successfully. Now the dfsreferral cache shows DC03 as the
active node. This failover is expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC03.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I then purge the dfsreferral cache (dfsutil /pktflush) This is the same
as a reboot in this context. We see 0 entries.
--mup.sys--
0 entries...
I then force a GPO update on the client. The DFSreferral is the same
with DC01 at the top of the list. The client fails to apply the GPO (XP
or W2K3). It generates a 1030,1058 combination indicating "The system
cannot find the file specified". A network trace shows the client
attempting to contact DC01 by arping for it (it continues to arp for
DC01 and makes no attempt to contact DC02 or DC03(. But the client
never fails over to an alternate DFS link. Note: the DFS referral table
shows nothing as active.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
I would expect the client to fail over to an alternate link, but this is
not happening.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:efLH3u2xEHA.3368@TK2MSFTNGP15.phx.gbl...
Hi Glenn
There's a hotfix for 1030 / 1058 events ...
842804 Group Policy processing does not work and events 1030 and 1058
are
http://support.microsoft.com/?id=842804
If this doesn't resolve the issue, I'd suggest logging a support
incident. I've seen a few instances of this issue and there's a long
and involved checklist of items that need to be worked through and
verified.
If you look for ealier posts from me, I think I've provided a
reasonably comprehensive list but I'm not certain this is everything.
Try the hotfix first and go from there I guess.
HTH
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to
email me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OoIzTc2xEHA.1404@TK2MSFTNGP11.phx.gbl...
Layout
site 1)DC01, member01
site 2)DC02
site 3)DC03
All W2K3 server
I'm testing member01's ability to failover to another DC for group
policy application in the event DC01 fails.
I verify member01 applies GPO sucessfully from DC01.
I pull the network tap on DC01 and force gpupdate on member01. It
successfully applies GPOs. (in other words it failed over to another
sysvol based on its existing DFS referral table)
If I reboot member01 or manually purge the DFS referral cache, GPO
application fails with 1030 & 1058 "the specified file cannot be
found" for the GPT.ini file.
The network trace shows the DFS referral to the client ordered with
DC01 at the top of the list.
Member01 sends out arp requests for DC01 until it times out. It does
not attempt to failover to another sysvol location. I thought it was
suppose to failover.
My question.
Should the client attempt to failover to another sysvol copy? (I
would think so)
Should the DFS server detect DC01 offline and not include it in the
DFS referral to the client?
--
Glenn L
CCNA, MCSE (2000,2003) + Security
|
|
|
| Back to top |
|
|
Mark Renoden [MSFT]
Guest
|
| Posted:
Wed Nov 17, 2004 5:41 am Post subject:
Re: group policy fails with userenv 1030,158 |
|
|
Hi Glenn
I've attempted to reproduce this using the same site config and ip address
ranges. I don't see the problem. Member01 successfully applies policy
after
Disable NIC on DC01
ipconfig /flushdns, nbtstat -R, dfsutil /pktflush on Member01
gpupdate /force on Member01
My best guess at this stage is some kind of strange virtual network issue.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OBdI0Y3yEHA.2016@TK2MSFTNGP15.phx.gbl...
| Quote: | Well, it is not the insite switch, since this switch controls what the DFS
referral response is.
This setting is not enabled by default. My DFS referral returns all
available copies of sysvol as you can see from my previous replies. This
verifies that switch is not being used.
I am including the network trace for review.
DC01 172.16.1.1/24, FHC site, all 5 FSMOs
DC02 172.16.2.1/24, BAL site
DC03 172.16.3.1/24, PRV site
ROUTER01 172.16.1.10/24, 172.16.2.10/24, 172.16.3.10/24
MEMBER01 172.16.1.2/24, FHC site, running network monitor.
The following steps were followed.
gpupdate /force on member01, verify 1704
disable NIC on DC01
ipconfig /flushdns, nbtstat -R, dfsutil /pktflush (all on member01)
start the trace.
execute gpupdate /force on member01.
wait until command finishes and user env 1030 and 1058 are reported.
stop the trace.
You will see after the dfsreferral, member01 continues to ping for DC01
until it times out. No attempt is made to use another DFS link from the
local cache.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:OCZ8d4qyEHA.4028@TK2MSFTNGP15.phx.gbl...
Hi Glenn
I just had a crack and reproducing the behaviour without using sites and
didn't see what you're describing. I'm wondering if this might be
related
to the /INSITE switch. Take a look at:
282071 Users Are Accessing a DFS Root Replica in a Remote Site
http://support.microsoft.com/?id=282071
It's been a while since I worked on a DFS case involving /INSITE but I
have
a vague memory that if INSITE is set and the only DFS root replicate in
the
site goes down, clients will have problems.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OU291iQyEHA.3844@TK2MSFTNGP12.phx.gbl...
I installed the hotfix, and it unfortunately had no impact.
It is possible this issue could be isolated to the VM environment I have
been testing in.
However, I suspect this behavior is reproducable on physical machines as
well.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:%23sCCtm4xEHA.4044@tk2msftngp13.phx.gbl...
Hi Glenn
I had a small part to play in the case that motivated this hotfix. I
just spoke to the guy who authored the article I pointed to before and
he
suggested it will probably be of assistance in your case.
If it doesn't help and you can't reproduce the behaviour on a Windows
2000 client, it's probably worth contacting Microsoft to have it
investigated.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to
email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:ugdsVx3xEHA.4028@TK2MSFTNGP09.phx.gbl...
Thanks Mark.
I am aware of the long comprehensive list of things to check for.
I'll
admit I have not gone through the list.
I'm not convinced there is anything on it that will help. This is a
very specific thing that only breaks GPO processing when I pull the
plug
on the DC. I plug the NIC back in and all is well.
I also tested the same thing using an XP client and it also fails in
the
same way.
After rebooting client, and with DC01 plugged in, the client XP or
W2K3
will apply GPO successfully.
dfsreferral cache shows DC01 as the active DFSLINK. This is to be
expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749248 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
1:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I unplug DC01 from the network, force a GPO update on the client, and
it (WinXP or W2K3) successfully fails over to an alternate DFS link
and
applies GPO successfully. Now the dfsreferral cache shows DC03 as the
active node. This failover is expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC03.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I then purge the dfsreferral cache (dfsutil /pktflush) This is the
same
as a reboot in this context. We see 0 entries.
--mup.sys--
0 entries...
I then force a GPO update on the client. The DFSreferral is the same
with DC01 at the top of the list. The client fails to apply the GPO
(XP
or W2K3). It generates a 1030,1058 combination indicating "The system
cannot find the file specified". A network trace shows the client
attempting to contact DC01 by arping for it (it continues to arp for
DC01 and makes no attempt to contact DC02 or DC03(. But the client
never fails over to an alternate DFS link. Note: the DFS referral
table
shows nothing as active.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
I would expect the client to fail over to an alternate link, but this
is
not happening.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:efLH3u2xEHA.3368@TK2MSFTNGP15.phx.gbl...
Hi Glenn
There's a hotfix for 1030 / 1058 events ...
842804 Group Policy processing does not work and events 1030 and 1058
are
http://support.microsoft.com/?id=842804
If this doesn't resolve the issue, I'd suggest logging a support
incident. I've seen a few instances of this issue and there's a long
and involved checklist of items that need to be worked through and
verified.
If you look for ealier posts from me, I think I've provided a
reasonably comprehensive list but I'm not certain this is everything.
Try the hotfix first and go from there I guess.
HTH
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to
email me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OoIzTc2xEHA.1404@TK2MSFTNGP11.phx.gbl...
Layout
site 1)DC01, member01
site 2)DC02
site 3)DC03
All W2K3 server
I'm testing member01's ability to failover to another DC for group
policy application in the event DC01 fails.
I verify member01 applies GPO sucessfully from DC01.
I pull the network tap on DC01 and force gpupdate on member01. It
successfully applies GPOs. (in other words it failed over to another
sysvol based on its existing DFS referral table)
If I reboot member01 or manually purge the DFS referral cache, GPO
application fails with 1030 & 1058 "the specified file cannot be
found" for the GPT.ini file.
The network trace shows the DFS referral to the client ordered with
DC01 at the top of the list.
Member01 sends out arp requests for DC01 until it times out. It
does
not attempt to failover to another sysvol location. I thought it
was
suppose to failover.
My question.
Should the client attempt to failover to another sysvol copy? (I
would think so)
Should the DFS server detect DC01 offline and not include it in the
DFS referral to the client?
--
Glenn L
CCNA, MCSE (2000,2003) + Security
|
|
|
| Back to top |
|
|
Glenn L
Guest
|
| Posted:
Wed Nov 17, 2004 9:37 am Post subject:
Re: group policy fails with userenv 1030,158 |
|
|
Did DC01 own the FSMOs?
Well, thanks for attempting to repro this issue.
When I was looking at the traces of successful GPO application, I noticed
something strange. MEMBER01 read the registry.pol file 2 bytes at a time
(from DC01) , instead of grabbing it in large chunks. I found
http://support.microsoft.com/?kbid=812599. I verified the DCs did not have
opportunistic locking disabled.
All the W2K3 servers are from the same syspreped image. This means the GUID
value in the 'cause' section is the same on member01, dc01, dc02, dc03 in my
test. It appears I uncovered this defect (812599) in W2K3.
I suppose it is possible this duplicate GUID value also could be affecting
the DFS failover issue.
I wish I had time to test this further, but I have been pulled to other
tasks.
Thanks again.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:ulbCJXDzEHA.3808@TK2MSFTNGP15.phx.gbl...
| Quote: | Hi Glenn
I've attempted to reproduce this using the same site config and ip address
ranges. I don't see the problem. Member01 successfully applies policy
after
Disable NIC on DC01
ipconfig /flushdns, nbtstat -R, dfsutil /pktflush on Member01
gpupdate /force on Member01
My best guess at this stage is some kind of strange virtual network issue.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OBdI0Y3yEHA.2016@TK2MSFTNGP15.phx.gbl...
Well, it is not the insite switch, since this switch controls what the
DFS referral response is.
This setting is not enabled by default. My DFS referral returns all
available copies of sysvol as you can see from my previous replies. This
verifies that switch is not being used.
I am including the network trace for review.
DC01 172.16.1.1/24, FHC site, all 5 FSMOs
DC02 172.16.2.1/24, BAL site
DC03 172.16.3.1/24, PRV site
ROUTER01 172.16.1.10/24, 172.16.2.10/24, 172.16.3.10/24
MEMBER01 172.16.1.2/24, FHC site, running network monitor.
The following steps were followed.
gpupdate /force on member01, verify 1704
disable NIC on DC01
ipconfig /flushdns, nbtstat -R, dfsutil /pktflush (all on member01)
start the trace.
execute gpupdate /force on member01.
wait until command finishes and user env 1030 and 1058 are reported.
stop the trace.
You will see after the dfsreferral, member01 continues to ping for DC01
until it times out. No attempt is made to use another DFS link from the
local cache.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:OCZ8d4qyEHA.4028@TK2MSFTNGP15.phx.gbl...
Hi Glenn
I just had a crack and reproducing the behaviour without using sites and
didn't see what you're describing. I'm wondering if this might be
related
to the /INSITE switch. Take a look at:
282071 Users Are Accessing a DFS Root Replica in a Remote Site
http://support.microsoft.com/?id=282071
It's been a while since I worked on a DFS case involving /INSITE but I
have
a vague memory that if INSITE is set and the only DFS root replicate in
the
site goes down, clients will have problems.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to
email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OU291iQyEHA.3844@TK2MSFTNGP12.phx.gbl...
I installed the hotfix, and it unfortunately had no impact.
It is possible this issue could be isolated to the VM environment I
have
been testing in.
However, I suspect this behavior is reproducable on physical machines
as
well.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:%23sCCtm4xEHA.4044@tk2msftngp13.phx.gbl...
Hi Glenn
I had a small part to play in the case that motivated this hotfix. I
just spoke to the guy who authored the article I pointed to before and
he
suggested it will probably be of assistance in your case.
If it doesn't help and you can't reproduce the behaviour on a Windows
2000 client, it's probably worth contacting Microsoft to have it
investigated.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to
email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:ugdsVx3xEHA.4028@TK2MSFTNGP09.phx.gbl...
Thanks Mark.
I am aware of the long comprehensive list of things to check for.
I'll
admit I have not gone through the list.
I'm not convinced there is anything on it that will help. This is a
very specific thing that only breaks GPO processing when I pull the
plug
on the DC. I plug the NIC back in and all is well.
I also tested the same thing using an XP client and it also fails in
the
same way.
After rebooting client, and with DC01 plugged in, the client XP or
W2K3
will apply GPO successfully.
dfsreferral cache shows DC01 as the active DFSLINK. This is to be
expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749248 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
1:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I unplug DC01 from the network, force a GPO update on the client,
and
it (WinXP or W2K3) successfully fails over to an alternate DFS link
and
applies GPO successfully. Now the dfsreferral cache shows DC03 as the
active node. This failover is expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC03.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I then purge the dfsreferral cache (dfsutil /pktflush) This is the
same
as a reboot in this context. We see 0 entries.
--mup.sys--
0 entries...
I then force a GPO update on the client. The DFSreferral is the same
with DC01 at the top of the list. The client fails to apply the GPO
(XP
or W2K3). It generates a 1030,1058 combination indicating "The
system
cannot find the file specified". A network trace shows the client
attempting to contact DC01 by arping for it (it continues to arp for
DC01 and makes no attempt to contact DC02 or DC03(. But the client
never fails over to an alternate DFS link. Note: the DFS referral
table
shows nothing as active.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
I would expect the client to fail over to an alternate link, but this
is
not happening.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in
message
news:efLH3u2xEHA.3368@TK2MSFTNGP15.phx.gbl...
Hi Glenn
There's a hotfix for 1030 / 1058 events ...
842804 Group Policy processing does not work and events 1030 and
1058
are
http://support.microsoft.com/?id=842804
If this doesn't resolve the issue, I'd suggest logging a support
incident. I've seen a few instances of this issue and there's a long
and involved checklist of items that need to be worked through and
verified.
If you look for ealier posts from me, I think I've provided a
reasonably comprehensive list but I'm not certain this is
everything.
Try the hotfix first and go from there I guess.
HTH
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to
email me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OoIzTc2xEHA.1404@TK2MSFTNGP11.phx.gbl...
Layout
site 1)DC01, member01
site 2)DC02
site 3)DC03
All W2K3 server
I'm testing member01's ability to failover to another DC for group
policy application in the event DC01 fails.
I verify member01 applies GPO sucessfully from DC01.
I pull the network tap on DC01 and force gpupdate on member01. It
successfully applies GPOs. (in other words it failed over to
another
sysvol based on its existing DFS referral table)
If I reboot member01 or manually purge the DFS referral cache, GPO
application fails with 1030 & 1058 "the specified file cannot be
found" for the GPT.ini file.
The network trace shows the DFS referral to the client ordered with
DC01 at the top of the list.
Member01 sends out arp requests for DC01 until it times out. It
does
not attempt to failover to another sysvol location. I thought it
was
suppose to failover.
My question.
Should the client attempt to failover to another sysvol copy? (I
would think so)
Should the DFS server detect DC01 offline and not include it in the
DFS referral to the client?
--
Glenn L
CCNA, MCSE (2000,2003) + Security
|
|
|
| Back to top |
|
|
Mark Renoden [MSFT]
Guest
|
| Posted:
Wed Nov 17, 2004 10:20 am Post subject:
Re: group policy fails with userenv 1030,158 |
|
|
Hi Glenn
Yes DC01 had all the FSMOs. I was also using a sysprep'd image ... Win2K3 +
all windows updates to 13th October 2004.
If you figure this out, please post back with the cause.
Cheers
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:elLTWYFzEHA.3184@TK2MSFTNGP10.phx.gbl...
| Quote: | Did DC01 own the FSMOs?
Well, thanks for attempting to repro this issue.
When I was looking at the traces of successful GPO application, I noticed
something strange. MEMBER01 read the registry.pol file 2 bytes at a time
(from DC01) , instead of grabbing it in large chunks. I found
http://support.microsoft.com/?kbid=812599. I verified the DCs did not
have opportunistic locking disabled.
All the W2K3 servers are from the same syspreped image. This means the
GUID value in the 'cause' section is the same on member01, dc01, dc02,
dc03 in my test. It appears I uncovered this defect (812599) in W2K3.
I suppose it is possible this duplicate GUID value also could be affecting
the DFS failover issue.
I wish I had time to test this further, but I have been pulled to other
tasks.
Thanks again.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:ulbCJXDzEHA.3808@TK2MSFTNGP15.phx.gbl...
Hi Glenn
I've attempted to reproduce this using the same site config and ip
address ranges. I don't see the problem. Member01 successfully applies
policy after
Disable NIC on DC01
ipconfig /flushdns, nbtstat -R, dfsutil /pktflush on Member01
gpupdate /force on Member01
My best guess at this stage is some kind of strange virtual network
issue.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OBdI0Y3yEHA.2016@TK2MSFTNGP15.phx.gbl...
Well, it is not the insite switch, since this switch controls what the
DFS referral response is.
This setting is not enabled by default. My DFS referral returns all
available copies of sysvol as you can see from my previous replies.
This verifies that switch is not being used.
I am including the network trace for review.
DC01 172.16.1.1/24, FHC site, all 5 FSMOs
DC02 172.16.2.1/24, BAL site
DC03 172.16.3.1/24, PRV site
ROUTER01 172.16.1.10/24, 172.16.2.10/24, 172.16.3.10/24
MEMBER01 172.16.1.2/24, FHC site, running network monitor.
The following steps were followed.
gpupdate /force on member01, verify 1704
disable NIC on DC01
ipconfig /flushdns, nbtstat -R, dfsutil /pktflush (all on member01)
start the trace.
execute gpupdate /force on member01.
wait until command finishes and user env 1030 and 1058 are reported.
stop the trace.
You will see after the dfsreferral, member01 continues to ping for DC01
until it times out. No attempt is made to use another DFS link from the
local cache.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:OCZ8d4qyEHA.4028@TK2MSFTNGP15.phx.gbl...
Hi Glenn
I just had a crack and reproducing the behaviour without using sites
and
didn't see what you're describing. I'm wondering if this might be
related
to the /INSITE switch. Take a look at:
282071 Users Are Accessing a DFS Root Replica in a Remote Site
http://support.microsoft.com/?id=282071
It's been a while since I worked on a DFS case involving /INSITE but I
have
a vague memory that if INSITE is set and the only DFS root replicate in
the
site goes down, clients will have problems.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to
email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OU291iQyEHA.3844@TK2MSFTNGP12.phx.gbl...
I installed the hotfix, and it unfortunately had no impact.
It is possible this issue could be isolated to the VM environment I
have
been testing in.
However, I suspect this behavior is reproducable on physical machines
as
well.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in message
news:%23sCCtm4xEHA.4044@tk2msftngp13.phx.gbl...
Hi Glenn
I had a small part to play in the case that motivated this hotfix. I
just spoke to the guy who authored the article I pointed to before
and he
suggested it will probably be of assistance in your case.
If it doesn't help and you can't reproduce the behaviour on a Windows
2000 client, it's probably worth contacting Microsoft to have it
investigated.
Kind regards
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to
email
me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:ugdsVx3xEHA.4028@TK2MSFTNGP09.phx.gbl...
Thanks Mark.
I am aware of the long comprehensive list of things to check for.
I'll
admit I have not gone through the list.
I'm not convinced there is anything on it that will help. This is a
very specific thing that only breaks GPO processing when I pull the
plug
on the DC. I plug the NIC back in and all is well.
I also tested the same thing using an XP client and it also fails in
the
same way.
After rebooting client, and with DC01 plugged in, the client XP or
W2K3
will apply GPO successfully.
dfsreferral cache shows DC01 as the active DFSLINK. This is to be
expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749248 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
1:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I unplug DC01 from the network, force a GPO update on the client,
and
it (WinXP or W2K3) successfully fails over to an alternate DFS link
and
applies GPO successfully. Now the dfsreferral cache shows DC03 as
the
active node. This failover is expected.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC03.aditest.swedish.org\sysvol] State:0x31 ( ACTIVE )
2:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
I then purge the dfsreferral cache (dfsutil /pktflush) This is the
same
as a reboot in this context. We see 0 entries.
--mup.sys--
0 entries...
I then force a GPO update on the client. The DFSreferral is the
same
with DC01 at the top of the list. The client fails to apply the GPO
(XP
or W2K3). It generates a 1030,1058 combination indicating "The
system
cannot find the file specified". A network trace shows the client
attempting to contact DC01 by arping for it (it continues to arp for
DC01 and makes no attempt to contact DC02 or DC03(. But the client
never fails over to an alternate DFS link. Note: the DFS referral
table
shows nothing as active.
--mup.sys--
1 entries...
Entry: \aditest.swedish.org\sysvol
ShortEntry: \aditest.swedish.org\sysvol
Expires in 10749008 seconds
UseCount: 0 Type:0x1 ( DFS )
0:[\DC01.aditest.swedish.org\sysvol] State:0x21 ( )
1:[\DC02.aditest.swedish.org\sysvol] State:0x21 ( )
2:[\DC03.aditest.swedish.org\sysvol] State:0x21 ( )
I would expect the client to fail over to an alternate link, but
this is
not happening.
--
Glenn L
CCNA, MCSE (2000,2003) + Security
"Mark Renoden [MSFT]" <markreno@online.microsoft.com> wrote in
message
news:efLH3u2xEHA.3368@TK2MSFTNGP15.phx.gbl...
Hi Glenn
There's a hotfix for 1030 / 1058 events ...
842804 Group Policy processing does not work and events 1030 and
1058
are
http://support.microsoft.com/?id=842804
If this doesn't resolve the issue, I'd suggest logging a support
incident. I've seen a few instances of this issue and there's a
long
and involved checklist of items that need to be worked through and
verified.
If you look for ealier posts from me, I think I've provided a
reasonably comprehensive list but I'm not certain this is
everything.
Try the hotfix first and go from there I guess.
HTH
--
Mark Renoden [MSFT]
Windows Platform Support Team
Email: markreno@online.microsoft.com
Please note you'll need to strip ".online" from my email address to
email me; I'll post a response back to the group.
This posting is provided "AS IS" with no warranties, and confers no
rights.
"Glenn L" <the.only(delete)@gmail.com> wrote in message
news:OoIzTc2xEHA.1404@TK2MSFTNGP11.phx.gbl...
Layout
site 1)DC01, member01
site 2)DC02
site 3)DC03
All W2K3 server
I'm testing member01's ability to failover to another DC for group
policy application in the event DC01 fails.
I verify member01 applies GPO sucessfully from DC01.
I pull the network tap on DC01 and force gpupdate on member01. It
successfully applies GPOs. (in other words it failed over to
another
sysvol based on its existing DFS referral table)
If I reboot member01 or manually purge the DFS referral cache, GPO
application fails with 1030 & 1058 "the specified file cannot be
found" for the GPT.ini file.
The network trace shows the DFS referral to the client ordered
with
DC01 at the top of the list.
Member01 sends out arp requests for DC01 until it times out. It
does
not attempt to failover to another sysvol location. I thought it
was
suppose to failover.
My question.
Should the client attempt to failover to another sysvol copy? (I
would think so)
Should the DFS server detect DC01 offline and not include it in
the
DFS referral to the client?
--
Glenn L
CCNA, MCSE (2000,2003) + Security
|
|
|
| Back to top |
|
|
|
|
|
|
FAQ
Memberlist
Register
Profile
Log in to check your private messages
Log in