| Author | Messages | |
barbermj
Posts:7
 | | 10/07/2008 1:47 PM |
| Hi all,
We are having some problems with clients not processing GPOs correctly
and while looking into, have found that the version numbers of our GPOs
don't seem to be reported correctly.
We have 5 different domain controllers, 2 Server 2003 SP2 and 3 Server
2003 R2. The SP2 ones have been around the longest, while the R2 ones
replaced other SP2 ones this past summer. When I point GPMC towards the
old DCs, both the AD and SYSVOL version numbers are the same. When I
point GPMC at the R2 servers, the AD version number is correct, but the
SYSVOL version shows 0. Everything I can find out there shows that the
two numbers should match after replication has completed.
SYSVOL replication seems to be working okay, as the file sets are all on
every SYSVOL where they should be and manually creating a file on one of
the SYSVOL shares gets it replicated to the others without issue.
Has something changed in R2 dealing with SYSVOL replication that might
cause the version numbers to show as 0? Or are there issues with having
R2 and plain old SP2 servers replicating SYSVOL to each other?
Thanks for any suggestions!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
| | | |
| darren
Posts:154
| | 10/07/2008 2:27 PM |
| Matt-
The SYSVOL version number comes from the gpt.ini file found in each GPO's
SYSVOL folder. If you are saying that the actual content within SYSVOL on
each DC is the same but its just that gpt.ini reflects a version number of
0, then you could have some issues with that particular file replicating
correctly. Check the date/timestamp of that file on the PDC emulator DC
(where GPO changes typically originate) to ones on those problem DCs. My
guess is that the problem DCs have old versions of that file. If so, you
could have a scenario where something is locking that file when SYSVOL tries
to replicate to it. One possible candidate is an anti-virus product
installed on those systems. Make sure your anti-virus software excludes that
gpt.ini file from scanning.
If that doesn't point the way, let me know.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpertT
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 10:38 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi all,
We are having some problems with clients not processing GPOs correctly and
while looking into, have found that the version numbers of our GPOs don't
seem to be reported correctly.
We have 5 different domain controllers, 2 Server 2003 SP2 and 3 Server 2003
R2. The SP2 ones have been around the longest, while the R2 ones replaced
other SP2 ones this past summer. When I point GPMC towards the old DCs,
both the AD and SYSVOL version numbers are the same. When I point GPMC at
the R2 servers, the AD version number is correct, but the SYSVOL version
shows 0. Everything I can find out there shows that the two numbers should
match after replication has completed.
SYSVOL replication seems to be working okay, as the file sets are all on
every SYSVOL where they should be and manually creating a file on one of the
SYSVOL shares gets it replicated to the others without issue.
Has something changed in R2 dealing with SYSVOL replication that might cause
the version numbers to show as 0? Or are there issues with having R2 and
plain old SP2 servers replicating SYSVOL to each other?
Thanks for any suggestions!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
| | | |
| barbermj
Posts:7
| | 10/07/2008 3:43 PM |
| Hi Darren,
The anti-virus is not scanning those files.
I had done the date/timestamp checking test in the past, but I just went
through one to confirm the results. I created a new GPO with my snap-in
pointed to the PDC emulator (which is one of the R2 servers). After
replication, all of the servers have the new policy, complete with a
GPT.ini file with the same timestamp across the board. At this point,
all of the DCs showed an AD and SYSVOL version of 0.
Still looking at the PDC emulator, I changed one setting in the GPO.
After replication, the timestamps match in the filesystem and my *Vista
SP1 x64* snap-in shows AD and SYSVOL version of 1. Note the emphasis,
because I then took a look with my XP SP3 snap-in, and it shows AD
version of 1, SYSVOL version of 0. I confirmed with another change that
my Vista snap-in seems to report the versions fine.
So it appears that my problem may just be in the reporting of my XP
snap-in. I guess I didn't notice that previously. Should the XP
snap-in be able to see the versions okay? I have been making changes
with my Vista one for Group Policy Preferences anyways.
This doesn't explain the other difficulties I have been having with our
policies, but I don't have enough details to speak to that yet.
Thanks for your help,
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 1:55 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
The SYSVOL version number comes from the gpt.ini file found in each
GPO's SYSVOL folder. If you are saying that the actual content within
SYSVOL on each DC is the same but its just that gpt.ini reflects a
version number of 0, then you could have some issues with that
particular file replicating correctly. Check the date/timestamp of that
file on the PDC emulator DC (where GPO changes typically originate) to
ones on those problem DCs. My guess is that the problem DCs have old
versions of that file. If so, you could have a scenario where something
is locking that file when SYSVOL tries to replicate to it. One possible
candidate is an anti-virus product installed on those systems. Make sure
your anti-virus software excludes that gpt.ini file from scanning.
If that doesn't point the way, let me know.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpert(tm)
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 10:38 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi all,
We are having some problems with clients not processing GPOs correctly
and while looking into, have found that the version numbers of our GPOs
don't seem to be reported correctly.
We have 5 different domain controllers, 2 Server 2003 SP2 and 3 Server
2003 R2. The SP2 ones have been around the longest, while the R2 ones
replaced other SP2 ones this past summer. When I point GPMC towards the
old DCs, both the AD and SYSVOL version numbers are the same. When I
point GPMC at the R2 servers, the AD version number is correct, but the
SYSVOL version shows 0. Everything I can find out there shows that the
two numbers should match after replication has completed.
SYSVOL replication seems to be working okay, as the file sets are all on
every SYSVOL where they should be and manually creating a file on one of
the SYSVOL shares gets it replicated to the others without issue.
Has something changed in R2 dealing with SYSVOL replication that might
cause the version numbers to show as 0? Or are there issues with having
R2 and plain old SP2 servers replicating SYSVOL to each other?
Thanks for any suggestions!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
| | | |
| darren
Posts:154
| | 10/07/2008 4:23 PM |
| Matt-
I don't think there should be a difference in *reporting* of version numbers
between XP and Vista. If you crack open the gpt.ini file on a DC for a given
GPO, it will show the version number right there. That is ultimately what
any of these tools are looking at. So, unless there is an actual replication
problem of that file in SYSVOL, I don't see why XP would report one value
and Vista another.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpertT
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 12:27 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi Darren,
The anti-virus is not scanning those files.
I had done the date/timestamp checking test in the past, but I just went
through one to confirm the results. I created a new GPO with my snap-in
pointed to the PDC emulator (which is one of the R2 servers). After
replication, all of the servers have the new policy, complete with a GPT.ini
file with the same timestamp across the board. At this point, all of the
DCs showed an AD and SYSVOL version of 0.
Still looking at the PDC emulator, I changed one setting in the GPO. After
replication, the timestamps match in the filesystem and my *Vista SP1 x64*
snap-in shows AD and SYSVOL version of 1. Note the emphasis, because I then
took a look with my XP SP3 snap-in, and it shows AD version of 1, SYSVOL
version of 0. I confirmed with another change that my Vista snap-in seems
to report the versions fine.
So it appears that my problem may just be in the reporting of my XP snap-in.
I guess I didn't notice that previously. Should the XP snap-in be able to
see the versions okay? I have been making changes with my Vista one for
Group Policy Preferences anyways.
This doesn't explain the other difficulties I have been having with our
policies, but I don't have enough details to speak to that yet.
Thanks for your help,
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 1:55 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
The SYSVOL version number comes from the gpt.ini file found in each GPO's
SYSVOL folder. If you are saying that the actual content within SYSVOL on
each DC is the same but its just that gpt.ini reflects a version number of
0, then you could have some issues with that particular file replicating
correctly. Check the date/timestamp of that file on the PDC emulator DC
(where GPO changes typically originate) to ones on those problem DCs. My
guess is that the problem DCs have old versions of that file. If so, you
could have a scenario where something is locking that file when SYSVOL tries
to replicate to it. One possible candidate is an anti-virus product
installed on those systems. Make sure your anti-virus software excludes that
gpt.ini file from scanning.
If that doesn't point the way, let me know.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpertT
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 10:38 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi all,
We are having some problems with clients not processing GPOs correctly and
while looking into, have found that the version numbers of our GPOs don't
seem to be reported correctly.
We have 5 different domain controllers, 2 Server 2003 SP2 and 3 Server 2003
R2. The SP2 ones have been around the longest, while the R2 ones replaced
other SP2 ones this past summer. When I point GPMC towards the old DCs,
both the AD and SYSVOL version numbers are the same. When I point GPMC at
the R2 servers, the AD version number is correct, but the SYSVOL version
shows 0. Everything I can find out there shows that the two numbers should
match after replication has completed.
SYSVOL replication seems to be working okay, as the file sets are all on
every SYSVOL where they should be and manually creating a file on one of the
SYSVOL shares gets it replicated to the others without issue.
Has something changed in R2 dealing with SYSVOL replication that might cause
the version numbers to show as 0? Or are there issues with having R2 and
plain old SP2 servers replicating SYSVOL to each other?
Thanks for any suggestions!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
| | | |
| FrancisO
Posts:7
| | 10/07/2008 4:33 PM |
| FYI. The Group Policy team blogged about GP version numbers in an article last year. Lots of great info...
It's available here:
http://blogs.technet.com/grouppolicy/archive/2008/01/08/understanding-the-domain-based-gpo-version-number-scripts-included.aspx
Francis
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: 7 octobre 2008 15:27
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi Darren,
The anti-virus is not scanning those files.
I had done the date/timestamp checking test in the past, but I just went through one to confirm the results. I created a new GPO with my snap-in pointed to the PDC emulator (which is one of the R2 servers). After replication, all of the servers have the new policy, complete with a GPT.ini file with the same timestamp across the board. At this point, all of the DCs showed an AD and SYSVOL version of 0.
Still looking at the PDC emulator, I changed one setting in the GPO. After replication, the timestamps match in the filesystem and my *Vista SP1 x64* snap-in shows AD and SYSVOL version of 1. Note the emphasis, because I then took a look with my XP SP3 snap-in, and it shows AD version of 1, SYSVOL version of 0. I confirmed with another change that my Vista snap-in seems to report the versions fine.
So it appears that my problem may just be in the reporting of my XP snap-in. I guess I didn't notice that previously. Should the XP snap-in be able to see the versions okay? I have been making changes with my Vista one for Group Policy Preferences anyways.
This doesn't explain the other difficulties I have been having with our policies, but I don't have enough details to speak to that yet.
Thanks for your help,
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 1:55 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
The SYSVOL version number comes from the gpt.ini file found in each GPO's SYSVOL folder. If you are saying that the actual content within SYSVOL on each DC is the same but its just that gpt.ini reflects a version number of 0, then you could have some issues with that particular file replicating correctly. Check the date/timestamp of that file on the PDC emulator DC (where GPO changes typically originate) to ones on those problem DCs. My guess is that the problem DCs have old versions of that file. If so, you could have a scenario where something is locking that file when SYSVOL tries to replicate to it. One possible candidate is an anti-virus product installed on those systems. Make sure your anti-virus software excludes that gpt.ini file from scanning.
If that doesn't point the way, let me know.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com<http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpert(tm)
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 10:38 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi all,
We are having some problems with clients not processing GPOs correctly and while looking into, have found that the version numbers of our GPOs don't seem to be reported correctly.
We have 5 different domain controllers, 2 Server 2003 SP2 and 3 Server 2003 R2. The SP2 ones have been around the longest, while the R2 ones replaced other SP2 ones this past summer. When I point GPMC towards the old DCs, both the AD and SYSVOL version numbers are the same. When I point GPMC at the R2 servers, the AD version number is correct, but the SYSVOL version shows 0. Everything I can find out there shows that the two numbers should match after replication has completed.
SYSVOL replication seems to be working okay, as the file sets are all on every SYSVOL where they should be and manually creating a file on one of the SYSVOL shares gets it replicated to the others without issue.
Has something changed in R2 dealing with SYSVOL replication that might cause the version numbers to show as 0? Or are there issues with having R2 and plain old SP2 servers replicating SYSVOL to each other?
Thanks for any suggestions!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
| | | |
| barbermj
Posts:7
| | 10/08/2008 8:47 AM |
| Hi Darren,
I just went through and checked the GPT.ini file on all of the domain
controllers and they are all identical, including the version number in
the file and the timestamp.
I then went through with my Vista snap-in and made sure all of them
showed the same version numbers and timestamps and they do.
So I went through with my XP snap-in and found something interesting.
All of the R2 DCs show the AD version correctly and the SYSVOL version
as 0. However, if I look at the old SP2 DCs, the AD and SYSVOL versions
match. From the XP client I can browse SYSVOL directly and looked at
each DC and opened up the file on each one, just to make sure my client
could actually read every file. So permissions seem just fine, as I
imagine they would since it is SYSVOL.
Anything else I should be looking at?
Thanks a ton for the help!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 3:57 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
I don't think there should be a difference in *reporting* of version
numbers between XP and Vista. If you crack open the gpt.ini file on a DC
for a given GPO, it will show the version number right there. That is
ultimately what any of these tools are looking at. So, unless there is
an actual replication problem of that file in SYSVOL, I don't see why XP
would report one value and Vista another.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpert(tm)
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 12:27 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi Darren,
The anti-virus is not scanning those files.
I had done the date/timestamp checking test in the past, but I just went
through one to confirm the results. I created a new GPO with my snap-in
pointed to the PDC emulator (which is one of the R2 servers). After
replication, all of the servers have the new policy, complete with a
GPT.ini file with the same timestamp across the board. At this point,
all of the DCs showed an AD and SYSVOL version of 0.
Still looking at the PDC emulator, I changed one setting in the GPO.
After replication, the timestamps match in the filesystem and my *Vista
SP1 x64* snap-in shows AD and SYSVOL version of 1. Note the emphasis,
because I then took a look with my XP SP3 snap-in, and it shows AD
version of 1, SYSVOL version of 0. I confirmed with another change that
my Vista snap-in seems to report the versions fine.
So it appears that my problem may just be in the reporting of my XP
snap-in. I guess I didn't notice that previously. Should the XP
snap-in be able to see the versions okay? I have been making changes
with my Vista one for Group Policy Preferences anyways.
This doesn't explain the other difficulties I have been having with our
policies, but I don't have enough details to speak to that yet.
Thanks for your help,
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 1:55 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
The SYSVOL version number comes from the gpt.ini file found in each
GPO's SYSVOL folder. If you are saying that the actual content within
SYSVOL on each DC is the same but its just that gpt.ini reflects a
version number of 0, then you could have some issues with that
particular file replicating correctly. Check the date/timestamp of that
file on the PDC emulator DC (where GPO changes typically originate) to
ones on those problem DCs. My guess is that the problem DCs have old
versions of that file. If so, you could have a scenario where something
is locking that file when SYSVOL tries to replicate to it. One possible
candidate is an anti-virus product installed on those systems. Make sure
your anti-virus software excludes that gpt.ini file from scanning.
If that doesn't point the way, let me know.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpert(tm)
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 10:38 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi all,
We are having some problems with clients not processing GPOs correctly
and while looking into, have found that the version numbers of our GPOs
don't seem to be reported correctly.
We have 5 different domain controllers, 2 Server 2003 SP2 and 3 Server
2003 R2. The SP2 ones have been around the longest, while the R2 ones
replaced other SP2 ones this past summer. When I point GPMC towards the
old DCs, both the AD and SYSVOL version numbers are the same. When I
point GPMC at the R2 servers, the AD version number is correct, but the
SYSVOL version shows 0. Everything I can find out there shows that the
two numbers should match after replication has completed.
SYSVOL replication seems to be working okay, as the file sets are all on
every SYSVOL where they should be and manually creating a file on one of
the SYSVOL shares gets it replicated to the others without issue.
Has something changed in R2 dealing with SYSVOL replication that might
cause the version numbers to show as 0? Or are there issues with having
R2 and plain old SP2 servers replicating SYSVOL to each other?
Thanks for any suggestions!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
| | | |
| darren
Posts:154
| | 10/08/2008 10:25 AM |
| I find it strange that the problem is simply one of XP viewing the version
of the GPO incorrectly but stranger things have happened. What tool are you
using, on XP and Vista, to view the version?
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Secure and configure your Windows desktops accurately every time without
having to learn or install new technology. Find out more about Desktop
Policy Manager at http://www.sdmsoftware.com/desktop_management
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Wednesday, October 08, 2008 5:44 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi Darren,
I just went through and checked the GPT.ini file on all of the domain
controllers and they are all identical, including the version number in the
file and the timestamp.
I then went through with my Vista snap-in and made sure all of them showed
the same version numbers and timestamps and they do.
So I went through with my XP snap-in and found something interesting. All
of the R2 DCs show the AD version correctly and the SYSVOL version as 0.
However, if I look at the old SP2 DCs, the AD and SYSVOL versions match.
>From the XP client I can browse SYSVOL directly and looked at each DC and
opened up the file on each one, just to make sure my client could actually
read every file. So permissions seem just fine, as I imagine they would
since it is SYSVOL.
Anything else I should be looking at?
Thanks a ton for the help!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 3:57 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
I don't think there should be a difference in *reporting* of version numbers
between XP and Vista. If you crack open the gpt.ini file on a DC for a given
GPO, it will show the version number right there. That is ultimately what
any of these tools are looking at. So, unless there is an actual replication
problem of that file in SYSVOL, I don't see why XP would report one value
and Vista another.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpertT
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 12:27 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi Darren,
The anti-virus is not scanning those files.
I had done the date/timestamp checking test in the past, but I just went
through one to confirm the results. I created a new GPO with my snap-in
pointed to the PDC emulator (which is one of the R2 servers). After
replication, all of the servers have the new policy, complete with a GPT.ini
file with the same timestamp across the board. At this point, all of the
DCs showed an AD and SYSVOL version of 0.
Still looking at the PDC emulator, I changed one setting in the GPO. After
replication, the timestamps match in the filesystem and my *Vista SP1 x64*
snap-in shows AD and SYSVOL version of 1. Note the emphasis, because I then
took a look with my XP SP3 snap-in, and it shows AD version of 1, SYSVOL
version of 0. I confirmed with another change that my Vista snap-in seems
to report the versions fine.
So it appears that my problem may just be in the reporting of my XP snap-in.
I guess I didn't notice that previously. Should the XP snap-in be able to
see the versions okay? I have been making changes with my Vista one for
Group Policy Preferences anyways.
This doesn't explain the other difficulties I have been having with our
policies, but I don't have enough details to speak to that yet.
Thanks for your help,
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 1:55 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
The SYSVOL version number comes from the gpt.ini file found in each GPO's
SYSVOL folder. If you are saying that the actual content within SYSVOL on
each DC is the same but its just that gpt.ini reflects a version number of
0, then you could have some issues with that particular file replicating
correctly. Check the date/timestamp of that file on the PDC emulator DC
(where GPO changes typically originate) to ones on those problem DCs. My
guess is that the problem DCs have old versions of that file. If so, you
could have a scenario where something is locking that file when SYSVOL tries
to replicate to it. One possible candidate is an anti-virus product
installed on those systems. Make sure your anti-virus software excludes that
gpt.ini file from scanning.
If that doesn't point the way, let me know.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpertT
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 10:38 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi all,
We are having some problems with clients not processing GPOs correctly and
while looking into, have found that the version numbers of our GPOs don't
seem to be reported correctly.
We have 5 different domain controllers, 2 Server 2003 SP2 and 3 Server 2003
R2. The SP2 ones have been around the longest, while the R2 ones replaced
other SP2 ones this past summer. When I point GPMC towards the old DCs,
both the AD and SYSVOL version numbers are the same. When I point GPMC at
the R2 servers, the AD version number is correct, but the SYSVOL version
shows 0. Everything I can find out there shows that the two numbers should
match after replication has completed.
SYSVOL replication seems to be working okay, as the file sets are all on
every SYSVOL where they should be and manually creating a file on one of the
SYSVOL shares gets it replicated to the others without issue.
Has something changed in R2 dealing with SYSVOL replication that might cause
the version numbers to show as 0? Or are there issues with having R2 and
plain old SP2 servers replicating SYSVOL to each other?
Thanks for any suggestions!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
| | | |
| mschrisran
Posts:15
| | 10/08/2008 10:55 AM |
| Do you get the same results with GPOTool /V?
Chris Ransom
Microsoft Certified Master - Server 2008 - Directory
Senior Product Planner
ITOE Assess and Plan
Microsoft Services - Managed Solutions
Email: chrisran@microsoft.com<mailto:chrisran@microsoft.com>
Office: 512.795.5749
Cell: 210.482.0157
Fax: 425.708.5237
Blog: http://www.chrisran.com<http://www.chrisran.com/>
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Wednesday, October 08, 2008 7:21 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
I find it strange that the problem is simply one of XP viewing the version of the GPO incorrectly but stranger things have happened. What tool are you using, on XP and Vista, to view the version?
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
www.sdmsoftware.com<http://www.sdmsoftware.com/>
Secure and configure your Windows desktops accurately every time without having to learn or install new technology. Find out more about Desktop Policy Manager at http://www.sdmsoftware.com/desktop_management
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Wednesday, October 08, 2008 5:44 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi Darren,
I just went through and checked the GPT.ini file on all of the domain controllers and they are all identical, including the version number in the file and the timestamp.
I then went through with my Vista snap-in and made sure all of them showed the same version numbers and timestamps and they do.
So I went through with my XP snap-in and found something interesting. All of the R2 DCs show the AD version correctly and the SYSVOL version as 0. However, if I look at the old SP2 DCs, the AD and SYSVOL versions match. From the XP client I can browse SYSVOL directly and looked at each DC and opened up the file on each one, just to make sure my client could actually read every file. So permissions seem just fine, as I imagine they would since it is SYSVOL.
Anything else I should be looking at?
Thanks a ton for the help!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 3:57 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
I don't think there should be a difference in *reporting* of version numbers between XP and Vista. If you crack open the gpt.ini file on a DC for a given GPO, it will show the version number right there. That is ultimately what any of these tools are looking at. So, unless there is an actual replication problem of that file in SYSVOL, I don't see why XP would report one value and Vista another.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com<http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpert(tm)
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 12:27 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi Darren,
The anti-virus is not scanning those files.
I had done the date/timestamp checking test in the past, but I just went through one to confirm the results. I created a new GPO with my snap-in pointed to the PDC emulator (which is one of the R2 servers). After replication, all of the servers have the new policy, complete with a GPT.ini file with the same timestamp across the board. At this point, all of the DCs showed an AD and SYSVOL version of 0.
Still looking at the PDC emulator, I changed one setting in the GPO. After replication, the timestamps match in the filesystem and my *Vista SP1 x64* snap-in shows AD and SYSVOL version of 1. Note the emphasis, because I then took a look with my XP SP3 snap-in, and it shows AD version of 1, SYSVOL version of 0. I confirmed with another change that my Vista snap-in seems to report the versions fine.
So it appears that my problem may just be in the reporting of my XP snap-in. I guess I didn't notice that previously. Should the XP snap-in be able to see the versions okay? I have been making changes with my Vista one for Group Policy Preferences anyways.
This doesn't explain the other difficulties I have been having with our policies, but I don't have enough details to speak to that yet.
Thanks for your help,
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 1:55 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
The SYSVOL version number comes from the gpt.ini file found in each GPO's SYSVOL folder. If you are saying that the actual content within SYSVOL on each DC is the same but its just that gpt.ini reflects a version number of 0, then you could have some issues with that particular file replicating correctly. Check the date/timestamp of that file on the PDC emulator DC (where GPO changes typically originate) to ones on those problem DCs. My guess is that the problem DCs have old versions of that file. If so, you could have a scenario where something is locking that file when SYSVOL tries to replicate to it. One possible candidate is an anti-virus product installed on those systems. Make sure your anti-virus software excludes that gpt.ini file from scanning.
If that doesn't point the way, let me know.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com<http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpert(tm)
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 10:38 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi all,
We are having some problems with clients not processing GPOs correctly and while looking into, have found that the version numbers of our GPOs don't seem to be reported correctly.
We have 5 different domain controllers, 2 Server 2003 SP2 and 3 Server 2003 R2. The SP2 ones have been around the longest, while the R2 ones replaced other SP2 ones this past summer. When I point GPMC towards the old DCs, both the AD and SYSVOL version numbers are the same. When I point GPMC at the R2 servers, the AD version number is correct, but the SYSVOL version shows 0. Everything I can find out there shows that the two numbers should match after replication has completed.
SYSVOL replication seems to be working okay, as the file sets are all on every SYSVOL where they should be and manually creating a file on one of the SYSVOL shares gets it replicated to the others without issue.
Has something changed in R2 dealing with SYSVOL replication that might cause the version numbers to show as 0? Or are there issues with having R2 and plain old SP2 servers replicating SYSVOL to each other?
Thanks for any suggestions!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
| | | |
| barbermj
Posts:7
| | 10/08/2008 11:05 AM |
| I agree it is pretty weird.
On Vista, "About Group Policy Management" shows version 6.0.0.1. On XP,
it shows version 1.0.2. MMC 3.0 for both.
I think these are the latest versions, as I installed RSAT on Vista
after SP1 to get that functional again. On XP I just installed the
GPMC and MMC 3.0 at some point. I do see the same results with multiple
XP machines.
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Wednesday, October 08, 2008 10:21 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
I find it strange that the problem is simply one of XP viewing the
version of the GPO incorrectly but stranger things have happened. What
tool are you using, on XP and Vista, to view the version?
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Secure and configure your Windows desktops accurately every time without
having to learn or install new technology. Find out more about Desktop
Policy Manager at http://www.sdmsoftware.com/desktop_management
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Wednesday, October 08, 2008 5:44 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi Darren,
I just went through and checked the GPT.ini file on all of the domain
controllers and they are all identical, including the version number in
the file and the timestamp.
I then went through with my Vista snap-in and made sure all of them
showed the same version numbers and timestamps and they do.
So I went through with my XP snap-in and found something interesting.
All of the R2 DCs show the AD version correctly and the SYSVOL version
as 0. However, if I look at the old SP2 DCs, the AD and SYSVOL versions
match. From the XP client I can browse SYSVOL directly and looked at
each DC and opened up the file on each one, just to make sure my client
could actually read every file. So permissions seem just fine, as I
imagine they would since it is SYSVOL.
Anything else I should be looking at?
Thanks a ton for the help!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 3:57 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
I don't think there should be a difference in *reporting* of version
numbers between XP and Vista. If you crack open the gpt.ini file on a DC
for a given GPO, it will show the version number right there. That is
ultimately what any of these tools are looking at. So, unless there is
an actual replication problem of that file in SYSVOL, I don't see why XP
would report one value and Vista another.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpert(tm)
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 12:27 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi Darren,
The anti-virus is not scanning those files.
I had done the date/timestamp checking test in the past, but I just went
through one to confirm the results. I created a new GPO with my snap-in
pointed to the PDC emulator (which is one of the R2 servers). After
replication, all of the servers have the new policy, complete with a
GPT.ini file with the same timestamp across the board. At this point,
all of the DCs showed an AD and SYSVOL version of 0.
Still looking at the PDC emulator, I changed one setting in the GPO.
After replication, the timestamps match in the filesystem and my *Vista
SP1 x64* snap-in shows AD and SYSVOL version of 1. Note the emphasis,
because I then took a look with my XP SP3 snap-in, and it shows AD
version of 1, SYSVOL version of 0. I confirmed with another change that
my Vista snap-in seems to report the versions fine.
So it appears that my problem may just be in the reporting of my XP
snap-in. I guess I didn't notice that previously. Should the XP
snap-in be able to see the versions okay? I have been making changes
with my Vista one for Group Policy Preferences anyways.
This doesn't explain the other difficulties I have been having with our
policies, but I don't have enough details to speak to that yet.
Thanks for your help,
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 1:55 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
The SYSVOL version number comes from the gpt.ini file found in each
GPO's SYSVOL folder. If you are saying that the actual content within
SYSVOL on each DC is the same but its just that gpt.ini reflects a
version number of 0, then you could have some issues with that
particular file replicating correctly. Check the date/timestamp of that
file on the PDC emulator DC (where GPO changes typically originate) to
ones on those problem DCs. My guess is that the problem DCs have old
versions of that file. If so, you could have a scenario where something
is locking that file when SYSVOL tries to replicate to it. One possible
candidate is an anti-virus product installed on those systems. Make sure
your anti-virus software excludes that gpt.ini file from scanning.
If that doesn't point the way, let me know.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpert(tm)
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 10:38 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi all,
We are having some problems with clients not processing GPOs correctly
and while looking into, have found that the version numbers of our GPOs
don't seem to be reported correctly.
We have 5 different domain controllers, 2 Server 2003 SP2 and 3 Server
2003 R2. The SP2 ones have been around the longest, while the R2 ones
replaced other SP2 ones this past summer. When I point GPMC towards the
old DCs, both the AD and SYSVOL version numbers are the same. When I
point GPMC at the R2 servers, the AD version number is correct, but the
SYSVOL version shows 0. Everything I can find out there shows that the
two numbers should match after replication has completed.
SYSVOL replication seems to be working okay, as the file sets are all on
every SYSVOL where they should be and manually creating a file on one of
the SYSVOL shares gets it replicated to the others without issue.
Has something changed in R2 dealing with SYSVOL replication that might
cause the version numbers to show as 0? Or are there issues with having
R2 and plain old SP2 servers replicating SYSVOL to each other?
Thanks for any suggestions!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
| | | |
| barbermj
Posts:7
| | 10/08/2008 11:25 AM |
| Hi Chris,
I do see the same thing with GPOtool. Rather than show the SYSVOL
version as 0 though, it shows it as "not found."
This part is interesting, because I used the same gpotool.exe (stored on
a network share) on both Vista and XP. So it doesn't appear to the
tools themselves, but something with the OS itself maybe?
Thanks for your help,
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Chris Ransom
Sent: Wednesday, October 08, 2008 10:51 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Do you get the same results with GPOTool /V?
Chris Ransom
Microsoft Certified Master - Server 2008 - Directory
Senior Product Planner
ITOE Assess and Plan
Microsoft Services - Managed Solutions
Email: chrisran@microsoft.com <mailto:chrisran@microsoft.com>
Office: 512.795.5749
Cell: 210.482.0157
Fax: 425.708.5237
Blog: http://www.chrisran.com <http://www.chrisran.com/>
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Wednesday, October 08, 2008 7:21 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
I find it strange that the problem is simply one of XP viewing the
version of the GPO incorrectly but stranger things have happened. What
tool are you using, on XP and Vista, to view the version?
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Secure and configure your Windows desktops accurately every time without
having to learn or install new technology. Find out more about Desktop
Policy Manager at http://www.sdmsoftware.com/desktop_management
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Wednesday, October 08, 2008 5:44 AM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi Darren,
I just went through and checked the GPT.ini file on all of the domain
controllers and they are all identical, including the version number in
the file and the timestamp.
I then went through with my Vista snap-in and made sure all of them
showed the same version numbers and timestamps and they do.
So I went through with my XP snap-in and found something interesting.
All of the R2 DCs show the AD version correctly and the SYSVOL version
as 0. However, if I look at the old SP2 DCs, the AD and SYSVOL versions
match. From the XP client I can browse SYSVOL directly and looked at
each DC and opened up the file on each one, just to make sure my client
could actually read every file. So permissions seem just fine, as I
imagine they would since it is SYSVOL.
Anything else I should be looking at?
Thanks a ton for the help!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 3:57 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
I don't think there should be a difference in *reporting* of version
numbers between XP and Vista. If you crack open the gpt.ini file on a DC
for a given GPO, it will show the version number right there. That is
ultimately what any of these tools are looking at. So, unless there is
an actual replication problem of that file in SYSVOL, I don't see why XP
would report one value and Vista another.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpert(tm)
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 12:27 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi Darren,
The anti-virus is not scanning those files.
I had done the date/timestamp checking test in the past, but I just went
through one to confirm the results. I created a new GPO with my snap-in
pointed to the PDC emulator (which is one of the R2 servers). After
replication, all of the servers have the new policy, complete with a
GPT.ini file with the same timestamp across the board. At this point,
all of the DCs showed an AD and SYSVOL version of 0.
Still looking at the PDC emulator, I changed one setting in the GPO.
After replication, the timestamps match in the filesystem and my *Vista
SP1 x64* snap-in shows AD and SYSVOL version of 1. Note the emphasis,
because I then took a look with my XP SP3 snap-in, and it shows AD
version of 1, SYSVOL version of 0. I confirmed with another change that
my Vista snap-in seems to report the versions fine.
So it appears that my problem may just be in the reporting of my XP
snap-in. I guess I didn't notice that previously. Should the XP
snap-in be able to see the versions okay? I have been making changes
with my Vista one for Group Policy Preferences anyways.
This doesn't explain the other difficulties I have been having with our
policies, but I don't have enough details to speak to that yet.
Thanks for your help,
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Darren Mar-Elia
Sent: Tuesday, October 07, 2008 1:55 PM
To: ActiveDir@mail.activedir.org
Subject: RE: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Matt-
The SYSVOL version number comes from the gpt.ini file found in each
GPO's SYSVOL folder. If you are saying that the actual content within
SYSVOL on each DC is the same but its just that gpt.ini reflects a
version number of 0, then you could have some issues with that
particular file replicating correctly. Check the date/timestamp of that
file on the PDC emulator DC (where GPO changes typically originate) to
ones on those problem DCs. My guess is that the problem DCs have old
versions of that file. If so, you could have a scenario where something
is locking that file when SYSVOL tries to replicate to it. One possible
candidate is an anti-virus product installed on those systems. Make sure
your anti-virus software excludes that gpt.ini file from scanning.
If that doesn't point the way, let me know.
Darren
****
Darren Mar-Elia
CTO & Founder
SDM Software, Inc.
"The Group Policy Experts"
www.sdmsoftware.com <http://www.sdmsoftware.com/>
Automate Group Policy audits and changes with the GPExpert(tm)
Scripting Toolkit http://www.sdmsoftware.com/group_policy_scripting
From: ActiveDir-owner@mail.activedir.org
[mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Barber, Matt
Sent: Tuesday, October 07, 2008 10:38 AM
To: ActiveDir@mail.activedir.org
Subject: [ActiveDir] AD/SYSVOL Version Numbers for GPOs
Hi all,
We are having some problems with clients not processing GPOs correctly
and while looking into, have found that the version numbers of our GPOs
don't seem to be reported correctly.
We have 5 different domain controllers, 2 Server 2003 SP2 and 3 Server
2003 R2. The SP2 ones have been around the longest, while the R2 ones
replaced other SP2 ones this past summer. When I point GPMC towards the
old DCs, both the AD and SYSVOL version numbers are the same. When I
point GPMC at the R2 servers, the AD version number is correct, but the
SYSVOL version shows 0. Everything I can find out there shows that the
two numbers should match after replication has completed.
SYSVOL replication seems to be working okay, as the file sets are all on
every SYSVOL where they should be and manually creating a file on one of
the SYSVOL shares gets it replicated to the others without issue.
Has something changed in R2 dealing with SYSVOL replication that might
cause the version numbers to show as 0? Or are there issues with having
R2 and plain old SP2 servers replicating SYSVOL to each other?
Thanks for any suggestions!
Matt Barber
Network Analyst / PC Support
Morrisville State College
315-684-6053
| | | |
|
|