Group Policy Health check on specific domain controller.

How we can do the Group Policy Health check on Specific domain controller.

If you are working in large AD environment then gpo related issues continues to come like syncing issues, version mismatch, gpt.ini missing and access deny errors.

Recently we encountered version mismatch issue with one of the critical domain policy.In my AD environments there are around 900+ domain controllers and that are in different countries. by the way we are also using the AGPM tool to control the gpo versions. if incase anything goes wrong we recover it from AGPM as well RMAD tool.

But only fews gpo are being managed in AGPM tool that are frequently changes .We can do the GPO health by GPOTool.exe. we should know about the GPO GUID as highlighted in below image.

Copy the unique ID of gpo and open the command prompt windows {CMD} on any of domain controllers.

Now execute the below command to get the gpo health check on specific domain controller.

We are doing the Health check on DC02 domain controller for Policy {79A24835-93A3-4240-8DEA-F35EF53780DE}.

You can see the version mismatch on this domain controller. The gpo CL-C-HomeDriveMapping-LS is not syncing to DC02 domain controller . it could be due to replication issues.

C:>gpotool /gpo:79A24835-93A3-4240-8DEA-F35EF53780DE
Validating DCsโ€ฆ
Available DCs:
DC02.Windowstechno.local
Searching for policiesโ€ฆ
Found 1 policies
Policy {79A24835-93A3-4240-8DEA-F35EF53780DE}
Friendly name: CL-C-HomeDriveMapping-LS
Error: Cannot access \DC02.Windowstechno.local\sysvol\Windowstechno.local\polic
ies{79A24835-93A3-4240-8DEA-F35EF53780DE}, error 2
Error: Cannot access \DC04.Windowstechno.local\sysvol\Windowstechno.local\polic
ies{79A24835-93A3-4240-8DEA-F35EF53780DE}, error 2
Details:
DC: DC02.Windowstechno.local
Friendly name: CL-C-HomeDriveMapping-LS
Created: 4/14/2019 3:58:05 PM
Changed: 4/19/2019 4:23:38 PM
DS version: 10(user) 0(machine)
Sysvol version: not found
Flags: 2 (user side enabled; machine side disabled)
User extensions: [{00000000-0000-0000-0000-000000000000}{2EA1A81B-48E5-45E9-8BB7
-A6E3AC170006}][{5794DAFD-BE60-433F-88A2-1A31939AC01F}{2EA1A81B-48E5-45E9-8BB7-A
6E3AC170006}]
Machine extensions: not found
Functionality version: 2
————————————————————
Errors found
C:>

AD health check also give the insight on GPO sync issue and version mismatch as per below images-

If you have any questions feel free to contact us on admin@windowstechno.com also follow us on facebook @windowstechno to get updates about new blog posts.

How useful was this post?

Click on a star to rate it!

Leave a Reply