I'm having trouble with group policy on Windows 8 / Server 2008R2

I have a Server 2008R2, set up as a DC/file/print server with group policies set up on a domain, and all of the Windows 7 clients pick up the group policies without a problem.  I have one computer that is running Win8.  It was running Win8 since Developer Preview, and upgraded with each iteration, and is now running RTM.  Although I never expected everything to work prior to RTM, I had hoped that GP would work at least in the RP version, but it didn't. 

I was able to join the PC to the domain, so connectivity to the server is no problem.  Additionally, file sharing and printing through that server, works as well.  Like I say, joining the domain was a non-event.  But for some reason I cannot get group policies to pull to the Win8 machine.  gpupdate /force gives me the following message:

C:\Users\rich>gpupdate /force
Updating policy...

Computer policy could not be updated successfully. The following errors were enc
ountered:

The processing of Group Policy failed because of lack of network connectivity to
 a domain controller. This may be a transient condition. A success message would
 be generated once the machine gets connected to the domain controller and Group
 Policy has successfully processed. If you do not see a success message for seve
ral hours, then contact your administrator.
User Policy could not be updated successfully. The following errors were encount
ered:

The processing of Group Policy failed because of lack of network connectivity to
 a domain controller. This may be a transient condition. A success message would
 be generated once the machine gets connected to the domain controller and Group
 Policy has successfully processed. If you do not see a success message for seve
ral hours, then contact your administrator.

To diagnose the failure, review the event log or run GPRESULT /H GPReport.html f
rom the command line to access information about Group Policy results.

C:\Users\rich>gpresult /h gpreport.html
INFO: The user does not have RSoP data.

C:\Users\rich>

I know my connectivity is good, I know I can talk to the server, I know I can print, I know I can save files to the server......   But I'm getting quite frustrated with not being able to get my group policies, which are quite simple - all they really do is map drives and move documents to the server, but I want it to be automated.

Any suggestions are appreciated. 

August 25th, 2012 11:07am

Hi,

Regarding this error message, please access the following link.

http://technet.microsoft.com/en-us/library/cc727259(v=ws.10)

Also, you may try to disjoin this computer from Domain and re-join it.

Free Windows Admin Tool Kit Click here and download it now
August 27th, 2012 9:54am

Hello Juke, 

Unfortunately, your link doesn't seem to work.  I'll have to try disjoining and rejoining later as I don't have time right now, but I do have doubts, as I tried doing a gpupdate right after restarting when I initially joined the domain.  After that failed, I added a printer on the server, and checked shared files on the server to be sure I could see them.  That works, as well.  Pinging the FQDN of the server works as does just the server name.  Right now, I need to take off - I'll try again later, though.  Thanks.

August 27th, 2012 2:30pm

Ok, I'm in the process of disjoining and rejoining.  I'm quite inexperienced with servers, and my server is running at home, and I'm running it to get experience, so the problems are giving me that experience.  ;)   I disjoined another computer that DOES work properly (a Win7 computer), and am rejoining it in conjunction.  I'm not quite sure how this works....  I thought the domain was Hopkins.home, but somehow, with both computers, adding them to the domain, it doesn't find Hopkins.home, but it finds Hopkins, and adds them to the domain.  After that, the FQDN is xxx.hopkins.home.  The server is server.hopkins.home. 

On the Win7 computer, everything goes smoothly as expected, and it says welcome to the domain, blah blah blah, click ok, ok, restart, blah blah blah, and it restarts as expected.  On the Win8 computer, it says welcome to the domain, then it gives me another pop-up, that says:

Changing the Primary Domain DNS name of this computer to "" failed.  
The name will remain "hopkins.home".
The error was:

The specified domain either does not exist or could not be contacted.

At this point, I click ok a couple times, it tells me to restart.  I'm going to stop here, and restart the computer, and I'll be back to add more after that.

Free Windows Admin Tool Kit Click here and download it now
August 28th, 2012 4:28am

After rebooting both computers, the Win7 machine ran gpupdate /force without a problem, but the Win8 machine gave me the exact same result as in my first post, above.  I can't think of anything except that there is something different about how Win8 deals with it.  I mean, it's entirely, absolutely, very possible (and likely) that I have something configured wrong in the server, but I also have to have something configured right, since the Win7 machines are all able to resolve it.  I just can't figure out what the problem is.

The domain permissions work, the domain users work on the computer, the domain users logged into the computer can access the shared files in the server, but the group policies don't work, and ADUC doesn't find a DC (I'm sure there's more, but those are the only domain tools I've tried).

I'd be really appreciative if someone could shed some light on this for me.

August 28th, 2012 5:19am

Hi,

Check your logon server on Windows 8 by running echo %logonserver%. If there is no value returned, you have not logged on to any domain controller. You need to make sure you could connect to your DC. You can refer to the link I mentioned above and check your event log info according to the resolution.

Free Windows Admin Tool Kit Click here and download it now
August 28th, 2012 11:00am

Thanks, Juke.

The echo returned my servername, so I am logging onto my DC.  Also, I just figured out why your link above didn't work for me before - the close paren at the end wasn't included in the hyperlink, so I've got the page, but I'm about to leave for work, so I'll have to look at that tonight when I get home.  Thanks.

August 28th, 2012 2:19pm

I ended up not having a chance to do this last night, and I won't be home tonight.  I will have to look at it tomorrow evening.
Free Windows Admin Tool Kit Click here and download it now
August 29th, 2012 2:18pm

Ok....  The link above doesn't quite match the eventID that I have, but it led me to look where I had not looked before.  So now I have errors from the event log.  I have a NETLOGON error, which I cannot explain, since I have no communication problem.  I've got a network drive created, I'm moving data between here and the server, and other computers (Win7) see it as a DC.  This computer (Win8) sees the DC, but doesn't see it AS a DC.  After the Netlogon error, there is a Group Policy Error.  This is an automatic update attempt that failed.  After that there are two SCHANNEL errors.  I'm not sure what those are.  I'm finding things online that suggest power settings as culprits, ZoneAlarm as the culprit (I'm not running ZoneAlarm anyway), and SSL / other security issues as the culprit (at least this one is remotely related to my issue, I guess).  After that, there are two Group Policy update attempts that fail, which are the gpupdate /force that I attempted while doing this research. 

The gpupdate is eventId 1129, which returns errorcode 1222, which of course (my luck) isn't listed on this page: http://technet.microsoft.com/en-us/library/cc727335(v=WS.10).aspx.  Regardless, it says that the network is not present, but it is.  I'm communicating with it.  I'm talking to the server with it.  I'm authenticating through the server with it.  I'm able to save files to the server with it, without separately typing in my credentials, so it has my credentials.  But for some reason it has become schitzophrenic and decided that it isn't who it thinks it is.  It is making me want to pull my hair out, and since I keep my hair less than a quarter of an inch long, that means I need to get a new pair of tweezers!

Below are the xml from the event logs for the above-mentioned errors:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="NETLOGON" /> 
  <EventID Qualifiers="0">5719</EventID> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Keywords>0x80000000000000</Keywords> 
  <TimeCreated SystemTime="2012-08-31T01:08:01.000000000Z" /> 
  <EventRecordID>2724</EventRecordID> 
  <Channel>System</Channel> 
  <Computer>xxxxxxxxx</Computer> 
  <Security /> 
  </System>
- <EventData>
  <Data>HOPKINS</Data> 
  <Data>%%1311</Data> 
  <Binary>5E0000C0</Binary> 
  </EventData>
  </Event>


- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" /> 
  <EventID>1129</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2012-08-31T01:29:06.927280100Z" /> 
  <EventRecordID>2725</EventRecordID> 
  <Correlation ActivityID="{C30E7AFA-AB5D-4722-9803-61A89629933B}" /> 
  <Execution ProcessID="964" ThreadID="9452" /> 
  <Channel>System</Channel> 
  <Computer>xxxxxxxxxxxxxxx</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="SupportInfo1">1</Data> 
  <Data Name="SupportInfo2">1532</Data> 
  <Data Name="ProcessingMode">0</Data> 
  <Data Name="ProcessingTimeInMilliseconds">1560</Data> 
  <Data Name="ErrorCode">1222</Data> 
  <Data Name="ErrorDescription">The network is not present or not started.</Data> 
  </EventData>
  </Event>


- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" /> 
  <EventID>36888</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2012-08-31T02:09:58.184092400Z" /> 
  <EventRecordID>2726</EventRecordID> 
  <Correlation ActivityID="{00000001-0000-0000-0000-000000000000}" /> 
  <Execution ProcessID="676" ThreadID="5372" /> 
  <Channel>System</Channel> 
  <Computer>xxxxxxxxxxxxxxxxxxxxx</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="AlertDesc">51</Data> 
  <Data Name="ErrorState">900</Data> 
  </EventData>
  </Event>


- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Schannel" Guid="{1F678132-5938-4686-9FDC-C8FF68F15C85}" /> 
  <EventID>36888</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2012-08-31T02:17:10.824691500Z" /> 
  <EventRecordID>2727</EventRecordID> 
  <Correlation /> 
  <Execution ProcessID="676" ThreadID="5328" /> 
  <Channel>System</Channel> 
  <Computer>xxxxxxxxxxxxx</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="AlertDesc">51</Data> 
  <Data Name="ErrorState">900</Data> 
  </EventData>
  </Event>


- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" /> 
  <EventID>1129</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2012-08-31T02:26:13.192886500Z" /> 
  <EventRecordID>2728</EventRecordID> 
  <Correlation ActivityID="{9CC36B90-3B9A-4368-A40C-80CAD1C3A75E}" /> 
  <Execution ProcessID="964" ThreadID="8680" /> 
  <Channel>System</Channel> 
  <Computer>xxxxxxxxxxxxxx</Computer> 
  <Security UserID="S-1-5-18" /> 
  </System>
- <EventData>
  <Data Name="SupportInfo1">1</Data> 
  <Data Name="SupportInfo2">1532</Data> 
  <Data Name="ProcessingMode">0</Data> 
  <Data Name="ProcessingTimeInMilliseconds">1545</Data> 
  <Data Name="ErrorCode">1222</Data> 
  <Data Name="ErrorDescription">The network is not present or not started.</Data> 
  </EventData>
  </Event>


- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
  <Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" /> 
  <EventID>1129</EventID> 
  <Version>0</Version> 
  <Level>2</Level> 
  <Task>0</Task> 
  <Opcode>0</Opcode> 
  <Keywords>0x8000000000000000</Keywords> 
  <TimeCreated SystemTime="2012-08-31T02:26:14.752813600Z" /> 
  <EventRecordID>2729</EventRecordID> 
  <Correlation ActivityID="{324F6B1A-C7FA-4950-AD63-1EB591573159}" /> 
  <Execution ProcessID="964" ThreadID="9612" /> 
  <Channel>System</Channel> 
  <Computer>xxxxxxxxxxxxxx</Computer> 
  <Security UserID="S-1-5-21-3069748094-2949003797-218957922-1103" /> 
  </System>
- <EventData>
  <Data Name="SupportInfo1">1</Data> 
  <Data Name="SupportInfo2">1532</Data> 
  <Data Name="ProcessingMode">0</Data> 
  <Data Name="ProcessingTimeInMilliseconds">1545</Data> 
  <Data Name="ErrorCode">1222</Data> 
  <Data Name="ErrorDescription">The network is not present or not started.</Data> 
  </EventData>
  </Event>
Any other ideas or thoughts are appreciated.  Thanks for the ones that have been offered.

 

August 31st, 2012 7:45am

Ok, so I just did another test, and came up with a different answer than I'd hoped for.  I tried logging into the Win8 computer with a different domain user account, and got the dreaded "no logon server available" message.  Why is it that every Win7 computer on the domain recognizes the server, This Win8 computer recognized it when I added it to the domain and when I logged in (I can now only assume that I'm on cached credentials ever since that first login), but not since?  I can read/write to the server and have all of the expected permissions (I'm of course the domain admin) when using it as a file server / print server, I can navigate to other computers on the network and see their drives as expected.  I've even mapped network drives that automatically reconnect on startup, and they work without fail.

Why in the world can't this computer see the DC/File server/DHCP server/DNS server as a logon server or a DC?  Is there something different about Win8 that I should know?  Is anyone out there using Win8 on a domain?  With Group Policies?

Free Windows Admin Tool Kit Click here and download it now
September 9th, 2012 12:37am

Oh - and this observation that I'm using cached credentials now explains why when I look at a file/folder's security settings, I see the guid instead of username for owner or permission.
September 9th, 2012 12:39am

Rich,

If it helps I was running 3 Windows 8 Enterprise machines on my 2008 R2 domain with GPO, and didn't encounter any problems whatsoever.

I've since upgraded my DC's to 2012.  Still no problems.

See's DNS, DHCP and can use UNC paths no problems.  No different to Windows 7 for me.

Alan

Free Windows Admin Tool Kit Click here and download it now
September 10th, 2012 5:20pm

Why in the world can't this computer see the DC/File server/DHCP server/DNS server as a logon server or a DC?  Is there something different about Win8 that I should know?  Is anyone out there using Win8 on a domain?  With Group Pol

September 12th, 2012 5:09am

The clock is right on the Win8 machine.  There are lots of errors in the log - everything that has to do with the automatic updates of gpolicy, and such.  I'll have to take a closer look at that, as well as at the server this weekend, as the rest of the week is pretty busy.  In fact, I'm not even sure I'll have time this weekend....  *shakes head*
Free Windows Admin Tool Kit Click here and download it now
September 13th, 2012 4:16am

I wish I had time to look at this computer now... I just noticed something weird.  I looked at properties of a folder, and happened to click on the security tab, and instead of showing the GUID of my user, it showed the domain\username.  I'm sure it had showed the GUID before.  Yet I tried to log in with a different domain user, and it told me that there was no login server available.  :/
October 11th, 2012 4:10am

It sounds to me like you have a DNS issue on the windows 8 server.  Make sure it's primary DNS is pointing to your DC hosting DNS.
Free Windows Admin Tool Kit Click here and download it now
October 13th, 2012 7:27am

Sorry to potentially resurrect an old post, but I am having the same issue.  I did, however, come across one thing that may potentially help, if the problem has not been solved.  Per the restriction listed in this article here:  http://support.microsoft.com/kb/2661254?wa=wsignin1.0 , I went ahead and installed certificate services on my primary DC (Used this blog post to provide a basis http://d3planet.com/rtfb/2009/11/10/install-certificate-services-on-windows-server-2008-r2/ ) and issued myself a 2048 bit certificate for the domain, as I figured Windows 8 may already have that restriction implemented.  Upon doing so, my test environment was able to have a Windows 8 PC join the domain and successfully pull group policy. 

I am still having a problem in the production environment, however, and I believe I may have a group policy issue with certificate auto enrollment, though I haven't had a chance to track that down yet.


-Cary
November 21st, 2012 2:36am

I am experiencing the same thing, any update on this?
Free Windows Admin Tool Kit Click here and download it now
August 23rd, 2013 4:40pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics