RE: [ActiveDir] OT: stuck processing policy

Fri, 26 May 2006 06:12:43 -0700

Title: OT: stuck processing policy

Hi Shariff (and Darren too!),

       Yeah, I saw some entries in WINS that I didn’t like.  I believe it is some issue where the computer is not fully into the domain.  Although others can use this particular computer with no issues whatsoever, next week I am going to work with the local admins to take it out of the domain and then put it back in, maybe even with a brand new IP.  Thanks for the responses!

 

Mike Thommes

   

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Navroz Shariff
Sent: Friday, May 26, 2006 7:45 AM
To: [email protected]
Subject: RE: [ActiveDir] OT: stuck processing policy

 

Mike,

 

Make sure you flush the local DNS cached entries as well if you think it's a client-side DNS issue. I had encountered a similar issue awhile back and I re-joined the box back to the domain after noting authentication errors in the event log. Darren gives many possible solutions and I would agree with him that it's probably that the client has lost its trust relationship with the domain. To be sure, see the eventlog, more specifically, the entries that deal with authentication.

 

-Shariff

 

 

 

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darren Mar-Elia
Sent: Thursday, May 25, 2006 5:38 PM
To: [email protected]
Subject: RE: [ActiveDir] OT: stuck processing policy

Ok. The purpose of MyGetUserName (and GetUserNameEx) is so that GP can impersonate the user for the purposes of applying user policy. GetUserNameEx returns the user name of the current thread. MyGetUserName basically calls GetUserNameEx and asks for the Fully Qualified DN of the current user. So, the fact that that is failing with an "internal error" (1359) could mean almost anything. It could mean that the user's FQDN is not available (not sure if its actually querying AD at that point or just querying the token) or it could mean that, if it is querying AD, that there isn't a good line to AD. Maybe the machine account has lost its secure channel to the domain, or maybe the user logged in using cached creds or something? I'm sorry I'm not more help here. I've seen this error a lot but have never been able to track it down to a specific thing. I would make sure DNS is configured correctly on the client, check the system event log on the client to ensure there are no errors related to authentication, etc.

 

Darren

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Thommes, Michael M.
Sent: Thursday, May 25, 2006 2:12 PM
To: [email protected]
Subject: RE: [ActiveDir] OT: stuck processing policy

Hi Darren!

    Here you go.  Thanks!

 

Mike Thommes

======================================================

 

USERENV(2bc.774) 11:20:27:665 ProcessGPOs:

USERENV(2bc.774) 11:20:27:665 EnterCriticalPolicySectionEx: Entering with timeout 600000 and flags 0x0

USERENV(2bc.774) 11:20:27:665 EnterCriticalPolicySectionEx: User critical section has been claimed.  Handle = 0x618

USERENV(2bc.774) 11:20:27:665 EnterCriticalPolicySectionEx: Leaving successfully.

USERENV(2bc.774) 11:20:27:665 ProcessGPOs:  Machine role is 2.

USERENV(2bc.774) 11:20:27:681 PingComputer: Adapter speed 100000000 bps

USERENV(2bc.774) 11:20:27:681 PingComputer:  First time:  0

USERENV(2bc.774) 11:20:27:681 PingComputer:  Fast link.  Exiting.

USERENV(2bc.774) 11:23:28:482 MyGetUserName:  GetUserNameEx failed with 1359.

USERENV(2bc.774) 11:23:28:482 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.

USERENV(2bc.774) 11:26:29:749 MyGetUserName:  GetUserNameEx failed with 1359.

USERENV(2bc.774) 11:26:29:749 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.

USERENV(2bc.774) 11:29:31:015 MyGetUserName:  GetUserNameEx failed with 1359.

USERENV(2bc.774) 11:29:31:015 MyGetUserName:  Retrying call to GetUserNameEx in 1/2 second.

USERENV(2bc.774) 11:32:32:271 MyGetUserName:  GetUserNameEx failed with 1359.

USERENV(2bc.774) 11:32:32:271 ProcessGPOs: MyGetUserName failed with 1359.

USERENV(2bc.774) 11:32:32:286 ProcessGPOs: No WMI logging done in this policy cycle.

USERENV(2bc.774) 11:32:32:286 ProcessGPOs: Processing failed with error 1359.

USERENV(2bc.774) 11:32:32:286 LeaveCriticalPolicySection: Critical section 0x618 has been released.

USERENV(2bc.774) 11:32:32:286 ProcessGPOs: User Group Policy has been applied.

USERENV(2bc.774) 11:32:32:286 ProcessGPOs: Leaving with 0.

USERENV(2bc.774) 11:32:32:286 ApplyGroupPolicy: Leaving successfully.

USERENV(2bc.548) 11:32:32:286 GPOThread:  Next refresh will happen in 104 minutes

 

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Darren Mar-Elia
Sent: Thursday, May 25, 2006 4:07 PM
To: [email protected]
Subject: RE: [ActiveDir] OT: stuck processing policy

 

Hi Mike. Can you post the lines of userenv right around that GetUserNameEx error?

 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Thommes, Michael M.
Sent: Thursday, May 25, 2006 1:44 PM
To: [email protected]
Subject: [ActiveDir] OT: stuck processing policy

I have a user on a computer that takes forever to log in.  She can go to any other computer and log in quickly.  Anyone else can go to the computer in question and log in quickly.  It is only THIS user on the THIS computer.  We have renamed her local profile to no avail.  Looking at the userenv.log debugging file, I see a big time gap marked by a “GetUserNameEx failed with 1359”.  Googling didn’t produce much.  Does anyone (Darren?) have any thoughts on how I can track this down?  Thanks!

Mike Thommes

Reply via email to