So in this module, I'm going to spend some time talking about a topic that is an unfortunate side effect
of using group policy.
And that's that sometimes you're going to run into problems when you apply group policy.
And you need to have the skills.
You need to know where to look and how to solve some of those basic issues.
So in this module, we're going to talk about some common group policy problems.
And I like to break those into three different categories.
Server side problems, which are essentially things that are happening as you're defining group policy
objects and deploying them.
Client side problems, which are the things that happen at the machine that's processing policy?
And then what I affectionately referred to as Adnan Syed problems.
Which are those things that we as admins do that can cause group policy to not work?
So let's dig into each of these.
So on the server side, the most often thing that I have seen is.
Issues with the sizable portion of the GPO replicating across all the main controllers consistently.
So this was a huge issue in the world of NTFS.
Which is the NT file replication service that was responsible for replicating sensible and DFS content
for many years.
And in fact, a lot of shops still run sizable on NTFS.
Even though I think since server 2008 or two, this new model has been or new technology called FSR
has been around.
It takes some work to get to FSR.
So if you haven't already converted cessful to SA replication, I highly recommend it.
As it usually makes the server side problem go away.
The other issues that I've seen, DNS issues.
So this is as much a client side issues as a server side issue.
But if your DNS infrastructure is not.
Working properly.
If the records for your discs aren't registered, then clients can't find discs and they can't find
group policy.
So that's a key piece, just like it is for Active Directory in general.
DNS is a big, you know, piece of the puzzle when it comes to troubleshooting server side issues.
And then GPL corruption is something that happens very infrequently.
And what this essentially is, is usually, again, through some file replication glitch or some other
problem while you're editing a GPO.
The actual files that store the GPO settings can get corrupted.
And when the client goes to read them, they just simply give up and fail.
So they they just can't make heads or tails of the setting files.
And just, you know, not expecting that kind of situation.
They just the client just fails.
So that those are issues that happen that you sort of have to keep an eye out for.
And again, this notion of the server side pieces of group policy and the two parts of group policy.
The ad and Siskel part are getting out of sync or just not having replicated to all Dickies yet.
When a client is expecting to see those new settings is an issue that you have to keep an eye out on.
So you've got this part of the GPO and add that these group policy container objects under system policies
container.
And then you've got a corresponding folder in system for each GPO.
And these exist on every domain controller.
And need to be essentially in in sync and consistent for policy to process correctly on every client.
And remember that clients will go preferentially to their closest domain controller.
So if you've got a change that originates on a PDC emulator DC in your data center.
And you're waiting to see the change.
Make it out to our branch office in Timbuktu.
Well, that Deasy in Timbuktu has to have the change replicated to it before that client over there
can process it.
So these are just, you know, piece of the puzzle that you have to keep in mind when you're deploying
group policy.
Now on the client side, much more frequent.
Do I see these kind of client side issues that cause problems with group policy?
And they have a myriad of causes.
So everything from the network stack not coming up or initializing on the network as the machine is
booting.
And that will typically result in failed computers, side processing CSC failures.
So clients side extensions when they run.
You'll remember from an earlier module, I talked about the core part of group policy processing, which
figures out which GPOs apply.
And then the client side extension part or each client side extension that's responsible for each policy
area runs in turn.
And if a particular client side extension is processing three or four GPOs.
And one of those GPUs has corrupted setting storage that's going to cause all of them to fail.
It'll simply give up.
So those kinds of CSC failures can happen from time to time.
The other one that's a little bit trickier is that, you know, you're trying to figure out why a particular
policy setting isn't working.
It may have actually applied successfully, but the impact or the effect you were expecting on it wasn't
the case.
Or wasn't consistent with what actually happened on the machine.
And this can be tricky because sometimes you set a, let's say, a generic policy setting for the Explorer
shell.
And the thing in the Explorer simply doesn't respect the policy or doesn't or or there's some unintended
side effect because you set that policy.
So this can be a little bit tricky to troubleshoot and you sort of have to trial and error it by turning
off the setting.
CSC Bugs, these do happen.
Client side extensions do get bugs in them just like any other software.
And sometimes things just don't work.
And it's not your fault.
It's Microsoft's fault.
So that's just something to be aware of.
And then, you know, the a pretty common one, which is that the machine account loses its trust with
the domain.
And this is, you know, simply all group policy processing fails.
And that it's a pretty obvious one, but it's one to keep in mind because sometimes you don't expect
that to be the reason.
And once you rejoin the machine to the domain, everything starts working again.
And then finally those Adnan Syed problems that I talked about.
So perfectly normal for there to be user error in in GP considering the complexity of it.
And this ranges from the easy to the hard.
So targeting errors are by far the most common.
I see.
Which is that folks confuse the fact that everything under computer configuration will only apply to
computer objects.
So they'll have a bunch of computer settings that they link to an IOU that only contains user objects.
And they wonder why those settings don't apply.
While it's exactly for that reason.
Or filtering errors.
They've set a group policy or a security group filter or a WMI filter, and that's not applying.
It's not working as expected, especially with WMI filters.
You know, you've created this query in WMI and you expect for a particular machine to pass the query
or not pass the query.
And that doesn't happen.
So that can be confusing.
And then there is what I call the impatience factor.
Which is essentially that, as I mentioned, in large environments, if you make a change to a GPO,
it can take a while to replicate around.
And if you're expecting all clients to receive the change instantly, it will not happen.
And then there's some known behaviors that are in group policy, such as the one that I brought up several
times.
Which is the synchronous foreground requirement for client side extensions.
Like folder redirection or software installation or GP preferences, drive mappings or it sometimes
can take.
To Boots or to log on for a setting to take effect.
So those are some common problem areas.
And now what I want to do is kind of shift gears and talk about how you can start to troubleshoot this
with the tools that are available in the box.