none
Computer configuration not applied - Event 1030 with error code 8341

    Question

  • Having an issue where the Computer configuration is not being applied but the User config is. Environment is 1 2k8r2 (SBS2011) DC  with a secondary DC on 2k8 and Win 10 workstations. The error message I get on a GPUpdate /Force is:

    The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.

    SupportInfo1 1
    SupportInfo2 3019
    ProcessingMode 0
    ProcessingTimeInMilliseconds 578
    ErrorCode 8341
    ErrorDescription A directory service error has occurred.
    DCName \\myDC.Domain.ca

    GPUpdate works fine on both DCs, but workstations aren't getting any Computer Config gpos. When I run a gpresult /r on a workstation, I can see that all the older GPOs have been applied, but nothing new is showing up. I'm not sure when the issue started - I only noticed because I was creating a new GPO. 

    I've been trying to figure this one out for about a week now so I'd be grateful for any help!


    Friday, January 13, 2017 3:23 PM

Answers

  • OK I figured it out!

    It did have to do with that LDAP dns entry. I ran the AD Best practice scan and it gave me a list of missing SRV records in my DNS. After some mucking about with trying to get the server to generate the proper records, I thought why not just create them? I created the _ldap, _kerberos and _kPasswd records under mydoman.com in the DNS server and tcp and now the DCDiag /test:dns tests are coming back successful and I am able to update the computer configuration GPOs without error. 

    Thanks for your help!

    Tuesday, January 17, 2017 4:33 PM

All replies

  • Hi,
    Please check event logs in the Event Viewer to see if other related events were logged. Besides, we can run command gpresult/h c:\gpreport.html with administrative privileges to collect group policy result to further check the error.
    In addition, have you tried to check the health of each domain controller and DNS? You could run dcdiag /v /c /q and dcdiag /test:dns on each DC to check if we could get more information to troubleshoot.
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Monday, January 16, 2017 6:19 AM
    Moderator
  • Hi!

    Unfortunately, I'm not turning up anything relevant in the event logs. I'm seeing a 1503 event in the System Log saying that 7 user GPOs were processed successfully but nothing on the computer config side. For what it's worth, I'm also seeing a DCOM 10016 event being logged as well, but I don't think it's part of this issue.

    Here's the log files you were asking about:

    I've already started to go down a bit of a rabbit hole with the DNS test results. This line in particular

    Name resolution is not functional. _ldap._tcp.mydomain.com. failed on the DNS server 192.168.1.3

    Seems significant but I haven't managed to sort it just yet. I'd love any ideas!

    Monday, January 16, 2017 5:01 PM
  • OK I figured it out!

    It did have to do with that LDAP dns entry. I ran the AD Best practice scan and it gave me a list of missing SRV records in my DNS. After some mucking about with trying to get the server to generate the proper records, I thought why not just create them? I created the _ldap, _kerberos and _kPasswd records under mydoman.com in the DNS server and tcp and now the DCDiag /test:dns tests are coming back successful and I am able to update the computer configuration GPOs without error. 

    Thanks for your help!

    Tuesday, January 17, 2017 4:33 PM
  • Hi,
    Great share, and we would appreciate you to mark it as answer, it will be greatly helpful to others who have the same question.
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Wednesday, January 18, 2017 1:53 AM
    Moderator