GPO's applied from wrong server?

  • Thread starter Thread starter RH
  • Start date Start date
R

RH

When I run gpresult on a workstation I have my GPO
applying from a server we have planned to remove from the
domain. I thought I had moved all of the FSMO's to the new
DC. What am I missing?

RH
 
Assuming everything is configured correctly in the domain - particularly dns, your
computers will receive Group Policy from another domain controller after that dc is
removed from the domain. To test it out you could temporarily shut down that dc, make
a Group Policy change on another domain dc, run secedit /refreshpolicy machine_policy
/enforce [or user_policy if appropriate], and then reboot that workstation and run
gpresult on it to see if new policy applies. Running netdiag [part of the free
support tools] on that workstation while logged on as a domain administrator should
show all the domain controllers in the domain in the dclist test. -- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;321708
 
GPOs get applied from whatever DC the workstation has found through the
normal DC locator process. That may or may not be a FSMO role-holder. Its
only GP editing that relies on looking for the PDC role-holder first. So if
you remove that DC, the workstation should find another one just fine.
 
Back
Top