[gurutech]

I'm trying to force a Vista machine to update policies using "gpupdate /force", but the "computer" policy fails every time. The user policy is OK, and both policies update successfully on my XP machine.

I get an error "access denied" on the vista machine, saying something about DFS not being installed - but why does this only occur on my Vista machine???

[davehc]

Have you tried from the command prompt, with Admin priviliges?

1. Click Start, point to All Programs, and then click Accessories.
2. Right-click Command Prompt, and then click Run as administrator.
3. Accept the User Account Control prompt.
4. In the Command Prompt window, type gpupdate /force.

[gurutech]

Yes, and I get the following error:

Updating Policy...

User Policy update has completed successfully.
Computer policy could not be updated successfully. The following errors were enc
ountered:

The processing of Group Policy failed. Windows attempted to read the file \\domain.local\sysvol\domain.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt
.ini from a domain controller and was not successful. Group Policy settings may
not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller
has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

To diagnose the failure, review the event log or invoke gpmc.msc to access infor
mation about Group Policy results.

[DaveA]

What version of Vista are you running?
Your listing says Vista RC2

[TechB]

Originally Posted by gurutech

To diagnose the failure, review the event log or invoke gpmc.msc to access infor
mation about Group Policy results.

Are there any related errors in the event logs on the Vista computer or the domain controller? It sounds like a permissions issue on that group policy file.

[gurutech]

Running Vista SP1 (Ultimate) - need to update my profile...

No error messagse in event log, other than what I've posted already. I don't think it's a permissions issue because my XP machines can update the policies just fine.

[TechB]

Vista is much more particular about DNS name resolution in a domain than XP. Can you post ipconfig /all from the Vista client and from the dc it authenticates with?

[DkPVS]

I too am having the same issue. It happens on all 4 Vista machines on the domain as well as the Server 2008 we are currently testing. Our DCs are Server 2000 and the domain functional level is 2000 native. I am running Vista Business SP1 on my box. I deleted the suspect policy and ran GPUpdate again to see if the policy was at fault. The same error occured on the next policy in line. The user policy will process-it is only the computer policy that fails.

[gurutech]

Is your server 2008 set up as a DC, or just stand-alone?

I'm running 2003 and have this problem - I can see having the problem on Win2K, as its policies may be "too old" for Vista.

Not sure though. Maybe Vista has a bug...

[DkPVS]

Gurutech,

Our Server 2008 is only an evaluation copy with no server roles enabled. The DCs are both W2K, which we will be upgrading to 2008 in a few months. The error occurs on the Server 2008 system (just like Vista) when GPUpdate is initiated. It must have something to do with the security on Vista and Server 2008.

I am running Group Policy from my Vista PC with the GPMC snap-in to take advantage of the new features-(IE: Group Policy Preferences). I am currently mapping a few drives and printers using this feature and it works beautifully...on XP clients...

I have been dealing with this for several weeks now. It all started when we began using WSUS 3.0 for updates. I had to remove/rejoin the domain before my Vista box would process the policy to use WSUS for updates. To get the Server 2008 and the other Vista clients to use WSUS, I manually edited the registry on each machine.

[gurutech]

What keys did you edit in the registry?

[DkPVS]

I made the following registry changes:

HKEY_LOCAL_MACHINE\SOFTWARE\
Policies\Microsoft\Windows\WindowsUpdate...

I had to add the "WindowsUpdate" key then add two string values to it:
"WUServer" with a value of http://Servername
"WUStatusServer" with a value of http://Servername

Then I added another key under the WindowsUpdate key named "AU".
To AU I added DWORD "UseWUServer" with a value of "1".

After adding the values to the registry and rebooting, the machines were then displayed in the WSUS console within 30 minutes.

You posted the exact same error when running GPUpdate that I am receiving:
The processing of Group Policy failed. Windows attempted to read the file \\domain.local\sysvol\domain.local\Policies\{XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}\gpt
.ini from a domain controller and was not successful. Group Policy settings may
not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller
has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.

I have checked and double checked a), b) and c) possible causes listed and can't find anything. I am getting Group Policy Event ID 7004 and 7017 errors in the event logs with an error code of 5 which is access denied. I found a Microsoft Support page which listed the sysvol permissions all the way down to the gpt.ini file in question and followed the suggested settings exactly. Same result. I am also running GPUpdate with full administrative rights.

I am thinking about running a Vista Virtual PC against a Server 2008 Virtual DC to see if I still have the same issues. I'm not sure if that will prove anything if successful though as there could be some setting in the domain causing the problem that wouldn't be reproduced virtually.

[DkPVS]

I have tested the issue in a virtual environment in two seperate domains against a Server 2008 DC as well as a Server 2000 DC. I have not been able to recreate the error and GPUdate is running perfectly on the Vista virtual machine. Anyone have any ideas?????

[DkPVS]

Solved!!!!!!!!!

The issue is in the MUP cache. Open a command prompt and type "dfsutil /spcflush" (without quotes) and shazam...No more errors!!!!

[gurutech]

Not working for me. I keep getting "RPC Server is unavailable" errors, but I have checked and that service is running just fine on the server.

Anyone know how to fix this error?