none
how to check why DC didn't received new GPO settings

    Question

  • Windows Server 2008 R2

    i have 3 DC in my domain. all of them received the GPO setting when i enabled account lockouts.

    now when i disabled account lockouts, for some reason, the PDC is still holding on to the old values (which is account lockout after 3 attempts). since the remaining DCs received the new GPO setting, i don't think there is an issue with WMI filtering, or scoping, or anything like that. they all belong to the same OU. and i use the Default Domain Policy.

    is there anything else i might have missed to check for why the PDC didn't received the new GPO settings?

    Thursday, April 09, 2015 11:34 AM

Answers

  • > is there anything else i might have missed to check for why the PDC
    > didn't received the new GPO settings?
     
    On the pdc, from an elevated prompt run "gpresult /h report.html &
    report.html" and verify the account settings this report shows, which
    policy they originate from and (in the list of applied policies) the
    version numbers of this policy.
     

    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    Thursday, April 09, 2015 11:55 AM

All replies

  • > is there anything else i might have missed to check for why the PDC
    > didn't received the new GPO settings?
     
    On the pdc, from an elevated prompt run "gpresult /h report.html &
    report.html" and verify the account settings this report shows, which
    policy they originate from and (in the list of applied policies) the
    version numbers of this policy.
     

    Greetings/Grüße, Martin

    Mal ein gutes Buch über GPOs lesen?
    Good or bad GPOs? - my blog…
    And if IT bothers me - coke bottle design refreshment (-:
    Thursday, April 09, 2015 11:55 AM
  • Hi Reno,

    How is it going? Did we follow the suggestions provided by Martin to look at the situation? If you need further help regarding the question, please don't hesitate to let us know.

    Best regards,
    Frank Shen


    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    Monday, April 13, 2015 5:17 AM
    Moderator
  • hi, yes everything seems to be in order at first glance. however, i couldn't spend more time on this as i'm starting Hyper-V deployments. might have to archive this one for the mean time.

    will update the thread once i get back. thanks.

    Monday, April 13, 2015 5:22 AM