(FYI) Turning off or blockinng ICMP (ping) causes group policy processing to fail

  • Thread starter Thread starter Mark Leddy
  • Start date Start date
M

Mark Leddy

Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1000
Date: 9/17/2003
Time: 2:26:55 PM
User: NT AUTHORITY\SYSTEM
Computer: Tellals
Description:
Windows cannot obtain the domain controller name for your computer
network. Return value (59).


http://www.microsoft.com/technet/tr...r2003/proddocs/deployguide/dmebb_gpu_zozl.asp

"Note:
Turning off the ICMP protocol will cause Group Policy processing to
fail. Turning off Read access on Active Directory containers that are
in the hierarchy of a user or computer object will cause Group Policy
processing for that object to fail."

We turned off ICMP at the routers so that Blaster would not spread,
then we implemented Group Policies and SUS to roll-out Q824146 and I
was banging my head until I found out GP was not working because of
turning off ping.
 
Hi Mark,

Please look at this article and make sure that all of the required
ports are open.

179442 How to Configure a Firewall for Domains and Trusts
http://support.microsoft.com/?id=179442

You may also want to run a utility we have called PortQry.exe.

310456 How to Use Portqry to Troubleshoot Active Directory
Connectivity Issues
http://support.microsoft.com/?id=310456

Portqry is a command-line utility that you can use to help
troubleshoot TCP/IP connectivity issues, which you can run on Windows
2000 and Windows XP. The utility reports the port status of target
Transition Control Protocol (TCP) and User Datagram Protocol (UDP)
ports on a remote computer.

You can also use Portqry in the following ways:

- To troubleshoot Active Directory issues in which you have to verify
basic TCP/IP connectivity, which can be especially useful in
environments with firewalls.

- To verify connectivity to TCP/IP ports that are used by Active
Directory for Lightweight Directory Access Protocol (LDAP), remote
procedure call (RPC), and Domain Name Service (DNS).

I hope this information helps.

Tom Ausburne (MS)
Windows 2000 Directory Services
This posting is provided "AS IS" with no warranties, and confers no
rights.
 
Back
Top