Problem sa deljenim folderima i group policy

[ kalasnikov @ 15.09.2006. 23:23 ] @

Server2003, DHCP, DNS, i XPSP1 kao klijenti. Nakon nekog cackanja zbog sporog logovanja klijenata!!! po grup polici (default domain policy) i postavljanja nekih windows servisa na Automatic kao startnu opciju desava mi se sledece:

-ne mogu da otvorim grup policy, iz razloga "Network path not found"

Procackam malo pa vidim da su sve te police stavljene u deljeni folder Sysvol ("gp.ini"). Problem je izgleda u sledecem:

Folderu sysvol ne mogu da pristupim sa servera kucanjem "\\server" pa dupli klik na Sysvol kao ni jednom deljenom folderu na serveru!!! (No access rights), medjutim najnormalnije ih otvaram iz explorera.

Group policy se ne primenjuje na klijentske racunare bas izgleda zbog toga a podizanje servera traje nenormalno dugo-"initializing network connections" barem 5 min.

Izgubih celo popodne (ajd objasnite to zeni!!!) zbog ovoga.
HVALA UNAPRED!!!

_{[Ovu poruku je menjao kalasnikov dana 20.09.2006. u 00:18 GMT+1]}

[ Vill @ 16.09.2006. 08:34 ] @

Sledeci put sacuvaj postavke kakve su bile u group polici-ju, pa onda
sacuvaj promene, ima sve lepo tamo, pa kada se desi ovako nesto znaces kako
da vrnes to nazad. Da nisi ti nesto iskljucivao od servisa u sistemu, jer
tako mi nesto mirise, cim se pali dugo.

[ kalasnikov @ 16.09.2006. 23:06 ] @

Nisam iskljucivao servise vec sam sve ukljucio a pre toga sam u group policy za sve servise u delu security obrisao jedan nepoznat korisnicki nalog (mislio sam da je to bio razlog sporog logovanja klijenata na domain).
Neka ideja?

[ kalasnikov @ 18.09.2006. 14:41 ] @

Pomagajte!!!
problem je i dalje tu

Code:

C:\Documents and Settings\Administrator>dcdiag

Domain Controller Diagnosis

Performing initial setup:
   Done gathering initial info.

Doing initial required tests

   Testing server: Default-First-Site\SERVER
      Starting test: Connectivity
         ......................... SERVER passed test Connectivity

Doing primary tests

   Testing server: Default-First-Site\SERVER
      Starting test: Replications
         ......................... SERVER passed test Replications
      Starting test: NCSecDesc
         ......................... SERVER passed test NCSecDesc
      Starting test: NetLogons
         [SERVER] An net use or LsaPolicy operation failed with error 1231, Win3
2 Error 1231.
         ......................... SERVER failed test NetLogons
      Starting test: Advertising
         ......................... SERVER passed test Advertising
      Starting test: KnowsOfRoleHolders
         ......................... SERVER passed test KnowsOfRoleHolders
      Starting test: RidManager
         ......................... SERVER passed test RidManager
      Starting test: MachineAccount
         Could not open pipe with [SERVER]:failed with 1231: Win32 Error 1231
         Could not get NetBIOSDomainName
         Failed can not test for HOST SPN
         Failed can not test for HOST SPN
         * Missing SPN :(null)
         * Missing SPN :(null)
         ......................... SERVER failed test MachineAccount
      Starting test: Services
         Could not open Remote ipc to [SERVER]:failed with 1231: Win32 Error 123
1
         ......................... SERVER failed test Services
      Starting test: ObjectsReplicated
         ......................... SERVER passed test ObjectsReplicated
      Starting test: frssysvol
         [SERVER] An net use or LsaPolicy operation failed with error 1231, Win3
2 Error 1231.
         ......................... SERVER failed test frssysvol
      Starting test: frsevent
         ......................... SERVER failed test frsevent
      Starting test: kccevent
         Failed to enumerate event log records, error Win32 Error 1231
         ......................... SERVER failed test kccevent
      Starting test: systemlog
         Failed to enumerate event log records, error Win32 Error 1231
         ......................... SERVER failed test systemlog
      Starting test: VerifyReferences
         ......................... SERVER passed test VerifyReferences

   Running partition tests on : TAPI3Directory
      Starting test: CrossRefValidation
         ......................... TAPI3Directory passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... TAPI3Directory passed test CheckSDRefDom

   Running partition tests on : ForestDnsZones
      Starting test: CrossRefValidation
         ......................... ForestDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... ForestDnsZones passed test CheckSDRefDom

   Running partition tests on : DomainDnsZones
      Starting test: CrossRefValidation
         ......................... DomainDnsZones passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... DomainDnsZones passed test CheckSDRefDom

   Running partition tests on : Schema
      Starting test: CrossRefValidation
         ......................... Schema passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Schema passed test CheckSDRefDom

   Running partition tests on : Configuration
      Starting test: CrossRefValidation
         ......................... Configuration passed test CrossRefValidation
      Starting test: CheckSDRefDom
         ......................... Configuration passed test CheckSDRefDom

   Running partition tests on : OSLjupceSpanac
      Starting test: CrossRefValidation
         ......................... OSLjupceSpanac passed test CrossRefValidation

      Starting test: CheckSDRefDom
         ......................... OSLjupceSpanac passed test CheckSDRefDom

   Running enterprise tests on : OSLjupceSpanac.local
      Starting test: Intersite
         ......................... OSLjupceSpanac.local passed test Intersite
      Starting test: FsmoCheck
         ......................... OSLjupceSpanac.local passed test FsmoCheck

[att_img]

Zasto DHCP dodeljuje serveru ovakvu adresu???

_{[Ovu poruku je menjao kalasnikov dana 18.09.2006. u 15:51 GMT+1]}

_{[Ovu poruku je menjao kalasnikov dana 18.09.2006. u 15:55 GMT+1]}

[ kalasnikov @ 19.09.2006. 23:22 ] @

Vidim da je problem u DNS-u jer server ne resolvuje imena shareovanih resursa i kako to da DHCP dodeljuje adresu serveru kad je on konfigurisan sa statickom adresom??? Pricam malo sa samim sobom da bih opet bio na vrhu i da mi neko ako se eventualno smiluje pomogne...HEEEEEEEEEEEEEEEEEELP!!!!!

[ S_tosha @ 20.09.2006. 10:38 ] @

Ono u DHCP leases nije problem. To je IP adresa za Remote access user-a.

Za problem grupne polise pogledaj permissions i sharing permissions na c:\windows\sysvol\sysvol\
U oba slucaja bi everyone trebalo da ima READ permission,a Administrators FULL access.

Pogledaj i sledeci link:
http://support.microsoft.com/kb/839499

[ kalasnikov @ 20.09.2006. 13:15 ] @

Citat:

S_tosha: Ono u DHCP leases nije problem. To je IP adresa za Remote access user-a.

Za problem grupne polise pogledaj permissions i sharing permissions na c:\windows\sysvol\sysvol\
U oba slucaja bi everyone trebalo da ima READ permission,a Administrators FULL access.

Pogledaj i sledeci link:
http://support.microsoft.com/kb/839499

Prvo HVALA Sinisi...

Premissions i sharing premissions su dobre jer shareovane foldere otvaram dobro lokalno, ali im ne modu pristupiti preko
\\server\share_name.
pogledah ovu temu, veoma slicno je i kod mene samo sto se resenje iz teme ne primenjuje na moj slucaj. Naime sva podesavanja ponudjena u resenju su kod mene OK.
Tema je bila "You cannot open file shares or Group Policy snap-ins when you disable SMB signing for the Workstation or Server service"
Medjutim kada pokrenem rsop.msc ispada da su pola od servisa koji bi trebali da rade na Disabled.

[att_img]

Kod mene su i Workstation i Server disabled...
Kako da resetujem default domain policy. Probao sam sa DCGPOFIX ali ni to ne uspeva...

Code:

This utility can restore either or both the Default Domain Policy or the
Default Domain Controllers Policy to the state that exists immediately after
a clean install. You must be a domain administrator to perform this operation.

WARNING: YOU WILL LOSE ANY CHANGES YOU HAVE MADE TO THESE GPOs. THIS UTILITY
IS INTENDED ONLY FOR DISASTER RECOVERY PURPOSES.

You are about to restore Default Domain policy and Default domain Controller po
licy for the following domain
OSLjupceSpanac.local
Do you want to continue: <Y/N>? y
WARNING: This operation will replace all 'User Rights Assignments' made in the c
hosen GPOs. This may render some server applications to fail. Do you want to con
tinue: <Y/N>? y
Unable to read EFS certificates from Registry.pol file of Default Domain Policy.
The error was
The network path was not found.
The restore failed. See previous messages for more details

POOOOOMoooC!!!

_{[Ovu poruku je menjao kalasnikov dana 20.09.2006. u 14:34 GMT+1]}

[ S_tosha @ 20.09.2006. 13:52 ] @

START > RUN > services.msc
pocni da ukljucujes servise 1 po jedan. Svaki servis ima objasnjenje cemu sluzi i od kojih drugih servisa zavisi i koji servisi od njega zavise, pa ces vec da provalis koji su ti neophodni za pocetak. Obavezno startuj SERVER, WORKSTATION, NET LOGON, Computer browser, RPC. Onda probaj ponovo default domain policy, i podesi te servise na automatic.

[ kalasnikov @ 20.09.2006. 14:07 ] @

Servisi su ukljuceni i rade najnormalnije...
[att_img]

[ S_tosha @ 21.09.2006. 07:00 ] @

Citat:

kalasnikov:
Premissions i sharing premissions su dobre jer shareovane foldere otvaram dobro lokalno, ali im ne modu pristupiti preko
\\server\share_name.

Ako ne mozes da im pristupis preko \\server\share_name, onda nesto ne valja, a to sigurno nije grupna polisa.

Citat:

kalasnikov: Vidim da je problem u DNS-u jer server ne resolvuje imena shareovanih resursa

DNS razresava imena u IP adrese i obrnuto, a ne pojedinacne share-ove na racunaru.
Sta se desava ako probas \\IP_adresa_servera\share_name ?
Probaj sa nekog racunra ping komandu sa -a parametrom, pa vidi da li ti razresava IP adresu u ime

Code:

C:\Documents and Settings\Administrator.BOJNIK>ping -a 192.168.46.5

Pinging primergy.bojnik.so.org.yu [192.168.46.5] with 32 bytes of data:

Reply from 192.168.46.5: bytes=32 time<1ms TTL=128
Reply from 192.168.46.5: bytes=32 time<1ms TTL=128
Reply from 192.168.46.5: bytes=32 time<1ms TTL=128
Reply from 192.168.46.5: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.46.5:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms

Da li se uopste racunari medjusobno "vide" ?

[ kalasnikov @ 22.09.2006. 23:04 ] @

Ping izmedju mashina radi najnormalnije. Deljenim folderima se ne može pristupiti sa Servera
radi \\Server
i vide se deljeni folderi...
ali ne radi
\\Server\sysvol ili bilo koji drugi deljeni folder

Sa radnih stanica isti slučaj

nisam probao Ping sa opcijom a, medjutim obican ping radi...

i jos nesto...

Defolt domain grup policy se nalazi u sysvol folderu kome mora pristupiti i DC. Pa posto sam ja u njoj najverovatnije greskom iskljucio neki od vitalnih servisa ili podesio pogresne security setings, DC ne moze da resolvuje cak ni svoju adresu
\\server\sysvol ?????

da dugacku pricu skratimo ni ni demote AD nije pomoglo, problem je ostao i posle toga i na kraju RESIO SAM GA!!!
HA HA HA HA HA a kako:

fromat c: :((((((((((((((((