applied GPO not change the setting

Hi,

the situation:

new WSUS server with the name WSUS2012 installed

In GPO related to WSUS the name of the server was changed from previous WSUS to new one - WSUS2012.

GPO is applied to OU Domain Controllers. I have a problem with one DC. The GPO is applied without problems. But the old name

of WSUS appears in log. Sure no connection to the new Server. Checked GPRESULT. Sure the old name appears.

And "sits" in registry.

I checked everything... The machine is DC, so it is in Domain Controllers. All other DCs got right GPO settings.

First wanted to ask WSUS forum... But finally it is pure GPO issue.

What to check?

As you can see below the name of old server appears :http://xx15vwsus    it should be http://xx15vwsus2012 like on all other machines

Windows Components/Windows Update
Policy Setting Winning GPO

href="javascript:void();">Configure Automatic Updates
Enabled WSUS Externe SERVEURS et PC NO restart
Configure automatic updating: 3 - Auto download and notify for install
The following settings are only required and applicable if 4 is selected.
Install during automatic maintenance  
Scheduled install day: 0 - Every day
Scheduled install time: 03:00
Policy Setting Winning GPO
Set the intranet update service for detecting updates: http://xx15vwsus
Set the intranet statistics server: http://xx15vwsus
(example: http://IntranetUpd01)
August 31st, 2015 12:52pm

Hi,
 
Is the old server still on the network and visible?
 
>>Sure the old name appears.

>>And "sits" in registry.
 
You mean the entry under HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate has the old server name listed?
 

Regards,

Eth

Free Windows Admin Tool Kit Click here and download it now
September 2nd, 2015 8:47am

Hi,

Have you attempted a gpupdate /force ? Did you create a new GPO for the WSUS setting or just change the setting in the existing GPO?

Do you have multiple DCs? If so.. I would also check by running CMD and type: ECHO %LOGONSERVER%

After running that, I would connect to the server and check the Group Policy has synchronized between domain controllers correctly.

If you run rsop.msc which can be run from Start -> Run or Windows Key +R.

Once this has completed, right-click on Computer Configuration and select Properties.
Now select the checkbox next to 'Display all GPOs and filtering status'. Make sure your GPO is within the list and it's status is Applied.

Let me know how you get on with the above steps.

Regards,
Adam

September 2nd, 2015 9:14am

Ethan,

> Is the old server still on the network and visible?

It is down from the moment that the name and port of the new server were changed in the existing GPO.

The network adapter is disabled  to be sure that this server cannot be connected to LAN.

> You mean the entry under HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate has the old server name listed?

Exact.

Found that 7 DCs from 16 not checked in to new WSUS. What is strange that the same GPO applied to Servers OU. and there are no problem.

In my initial post you can see that in Resultant the GPO shows winning. Should mean really applied I guess?

But the entry shows old name.

Looks like simpe no synchro between DCs. From the other hand the same GPO is applied to other OU...

will check more...

Any ideas ?

Thx.

Free Windows Admin Tool Kit Click here and download it now
September 2nd, 2015 3:14pm

I am back to GPO problem. Have time to take a closer look...

the situation becomes even more "interesting"

as mentioned, 7 out of 16 DCs are not checked in to new WSUS.

The "simple" sync question is out of picture.

I connected to one of DCs that has failed WSUS updates and checked WSUS GPO on it.

I was sure that it will show old name theoretically blaming sync, before start to troubleshoot in this direction...

Surprisingly, new WSUS name with the port are in place...

Next. I run Group Policy Result Wizard on dc in question against itself. And it showed WRONG (old name).

That allowed to conclude that the problem is really related to GPO application on server itself.

The GPO was changed a week ago.

For fun I restarted the server. It didn't help with correct policy application. It is still winning, no errors but the server name stays on old.

Desperately :), I run GPUPDATE /force...

Ta-da! It immediately worked.

The question:

What is going ON? I could understand if it was on one machine but why on 7 out of 16.

Thx.

September 3rd, 2015 9:19am

This may just be some replication/refresh issue. GPO is not get refreshed on some DC, probably due to some policy history on the machine.

Free Windows Admin Tool Kit Click here and download it now
September 3rd, 2015 10:33pm

Hi,
 
Thanks for the update. First it's good to hear that you are unblocked now.
 
There are situations that the computer's registry might need to be refreshed, even though the GPO is listed. I was about to suggest you to delete the Group Policy history on the faulty DCs, so that the machine is not aware of any GPOs that have been applied previously.
 
(HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Group Policy\History)
 
Another way to force a registry refresh is to use the Gpupdate /force command. It's always a good idea to run Gpupdate /force command everytime you apply/update a GPO.
 

Regards,

Eth

September 3rd, 2015 10:47pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics