All RODCs do not apply 'User Rights Assignment' part of Default Domain Controllers Policy, 'Policy server is not ready'

-

hi, noticed of our rodcs (all on windows server 2012 r2) not apply 'user rights assignment' part of default domain controllers policy. have state valid during promotion. if promote new rodc, 1 gets current user rights assignment, not apply changes done after promotion.

writable dcs apply policy without issues.

i enabled debug logging, , seems following happens:

  1. user rights added
  2. "policy server not ready"
  3. user rights removed again (changes step 1 undone)
  4. start on 1.

i uploaded complete winlogon.log here: 

https://www.amazon.de/clouddrive/share/ea7usyzo95hksrigte6zwbmlk5epbuxswdu2kmm2nxl?ref_=cd_share_link_copy

the relevant portions seem these:

----configure user rights... ... 	configure s-1-5-21-xxxxxxxxxx-yyyyyyyyyy-zzzzzzzzzz-84077. 		add seauditprivilege. 		add seservicelogonright. ... 	user rights configuration completed successfully. ... ----un-initialize configuration engine...  policy server not ready, retry count #1. ... ----configure user rights... 		seimpersonateprivilege must assigned administrators. setting adjusted. 		seimpersonateprivilege must assigned service. setting adjusted. 		senetworklogonright must assigned enterprise controllers account policy propagation , replication succeed. .... 	configure s-1-5-21-xxxxxxxxxx-yyyyyyyyyy-zzzzzzzzzz-84077. 		remove seauditprivilege. 		remove seservicelogonright. ... 	user rights configuration completed successfully.


as said before, happens on read domain controllers, not on writable domain controller.

our domain functional level 2008 r2. have idea reason, or continue investigate?


oh, forgot post solution here :(

in our case, reason gpo linked @ domain root added users local "administrators" group. since dc not have local administrators group, fails - , whatever reason, rodcs fail security policies then.

solution exclude dcs gpo.

http://theitcrownd.blogspot.bg/2014/05/security-policy-1001.html



Windows Server  >  Directory Services



Comments

Post a Comment

Popular posts from this blog

Group Policy Event ID 1058 Error Code 1326 (The user name or password is incorrect)

-
i seeing odd error on 1 of our domain controllers. have dealt event id 1058 errors whereby policy (or policies) not replicating, receiving error along error code 1326 on server, , apparently happening default domain policy: log name:      system source:        microsoft-windows-grouppolicy date:          8/10/2015 3:09:54 pm event id:      1058 task category: none level:         error keywords:      user:          s-1-5-21-1484152634-2550175353-3916092219-3287 computer:      <dc name>.<domainname> description: processing of group policy failed. windows attempted read file http://schemas.microsoft.com/win/2004/08/events/event ">   <system>     <provi...
Read more

Suspicious event log Event ID: 4905

-
hi thr, could please me understand causing such event logs generate ? as  i understand, vssvc.exe pertains volume shadow copy used backup purpose.  we have third party application used taking backup of servers. the event longs generated following messages: 1) attempt made unregister security event source. 2) attempt made register security event source. these events not regular generated on random days. standard fields: date:               2013/10/19 time:               02:32:19 importance:         critical rule name:          security event monitored machine:  <domain controller> log format:         windows log name:           security event id:           4905 in work hours:      yes dynamic fields: internal timestamp: 2013/10/19 ...
Read more

DCOM received error "2147746132" from...

-
hi everybody, i have dc (my windows essentials 2012 server) , windows 2012 server in network.  the windows server 2012 inside domain. on server, got "non stopping" error says in event logs : ===> dcom received error "2147746132" fromd computer xxxx(my dc computer) while server trying activation : {6df8cb71-153b-4c66-8fc4-e59301b8011b} it never stops, got 11000+ new events :s i found : http://support.microsoft.com/kb/971153/fr i'm not sure should ? does got idea ? matthieu. hi, please try solution mentioned in below link: http://www.eventid.net/display-eventid-10006-source-dcom-eventno-272-phase-1.htm regards, cicely Windows Server  >  Windows Server 2012 General ...
Read more