Default Domain policy with 2 DC's

[DJ]

All,

This one is weird. I have 2 domain controllers both W2k
SP4 with Active directory installed. I have setup a
default domain policy a while ago. Today i modified it on
DC1 to add some start up scripts.

Problem i am seeing is that if a computer is authenticated
and allocated an IP from DC2, then the default domain
policy is different.

I have been using the MMC console with the Resultant set
of a policy tool. I can physically see what Domain
controller authenticated the computer by doing an
Ipconfig /all and checking the DHCP server. If it's from
DC2, then the policy is not what I expect it to be.

If it's from DC1, then the policy is what I expect to see
with the new startup scripts. I thought that active
directory was supposed to replicated the default domain
polcy to other active directory domain controllers. It
seems that's not happning.

Worst of all, if I reboot the box, it's a 50, 50 change of
what DC will authenticate the computer and witch Domain
policy it will receive. WHAT GIVES!!!! Im almost outta
hair here. Any Ideas?

TIA

DJ

 

[Jody Flett]

You are correct Domain based policies are replicated between DC's, it sounds
like you DC's are not in sync.Group policy is stored in two places, both in
the active directory and this is replicated using the AD replication and
also part of the GP is stored on the file system in the SYSvol share on your
DC's. The sysvol share is replicated using NTFRS.

Ensure that AD replication is succeeding in both directions by using
repadmin /showreps and also check that ntfrs replication of sysvol is
working by dropping a test txt file into the sysvol share and this should
replicate to the other DC.

more information on troubleshooting frs at www.microsoft.com/frs

HTH

Jody