So, after I run the gpotool /checkacl, I ended up piping it to a text file, and the errors it finds, are version mismatches on the server I knew about.
Here's where I stand: 3 DCs MoDC01 - 2K3 Virtual MoDC04 - 2K8 Virtual WSDC02 - 2K3 Physical GPMC is installed on MoDC04, and that's where I made the GP change. The change is to a policy we call Member Server Policy, and I added a login banner to it. Prior to this change, the login banner that existed was input manually, most into the Local Security Policy, and a few to the registry at: Machine\Software\Microsoft\Windows NT\Winlogin\. Immediately after applying the GPO change on MoDC04, I went back through the servers that were set manually before, and deleted the entries in Local Security Policy, and the registry (data, not the keys themselves) Yesterday afternoon, I noticed some client servers weren't updating the GPO. I tried gpupdate /force with no luck. This morning, after troubleshooting, I found that the "bad" clients are connected to various DCs for logonserver. Also found out that MoDC01 does not have the changes made to the GPO. MoDC04 and WSDC02 are both the same, with the latest changes. I've looked at replmon, which shows all sucesses. I've turned on verbose logging on a client server that is having issues, and it doesn't list the Member Server Policy at all. I've used gpotool, and the errors it shows are the version mismatches on MoDC01. There's nothing in that report showing lack of rights/credentials to process the GPOs. Bottom line: I have client servers that are not updating this new GPO, some trying to get it from MoDC01, some trying to get it from WSDC02, and one or two trying to get it from MoDC04. >>> "Free, Bob" <[email protected]> 9/9/2009 12:45 PM >>> It's far easier and more thorough to check GPOs with GPOtool.exe (ResKit). AD can be replicating fine but if FRS is having issues so can your GPO. It will evaluate both the GPT (sysvol portion replicated by FRS) and the GPC (AD portion replicated by DS replication) for any inconsistencies. It can optionally check the sysvol ACL which can also be a problem occasionally. I would run gpotool /checkacl from a system in the domain that is encountering issues. That way you can rule out any inconsistencies with the GPO plumbing on all the DCs before you start mucking around with clients. ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
