Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We use Active Directory, but one computer in particular has a slight issue. When you log into the domain (regardless of the user account used) it will not work the first time round. Windows will say it cannot find the user on the domain, the Event Log only had this to say (wrapped in code blocks to make it easier to see):

The processing of Group Policy failed. Windows attempted to read the file
\\xxxx.local\SysVol\xxxxx.local\Policies\{448DC634-5296-4D65-BA4A-8D2BF90380C2}\gpt.ini from a domain controller and was not successful. 
Group Policy settings may not be applied until this event is resolved. 
This issue may be transient and could be caused by one or more of the following: 

a) Name Resolution/Network Connectivity to the current domain controller. 

b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). 

c) The Distributed File System (DFS) client has been disabled.

If you log off, then back on again, it will work perfectly OK.

Has anyone come across something like this before? I originally thought it may have been some Windows Services not starting up, but that doesn't seem to be the issue.

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Oh boy, do I love errors like these. I don't know the cause for this one, but it should be possible to determine the cause within a day or two.

First of all, the most likely reasons for the error message are listed right there.

Name Resolution/Network Connectivity to the current domain controller.
Is the domain controller on the local subnet? Do you connect to the DC via VPN? Do you connect to the DC over WAN? Does your network possibly suffer from a defective DNS server (meaning it is slow or otherwise broken)?
All these could cause your client to be temporarily unable to retrieve the group policy object from the DC. Unless these can be ruled out, no need to look further.

File Replication Service Latency
As the next point will show, domain controllers in a Windows domain share files in a distributed file storage system. Meaning the actual files stored in it are replicated to all DCs. So it might be possible that a certain file isn't yet available on the target DC.
I would say this is unlikely, as this issue seems to be reproducible.

The Distributed File System (DFS) client
Is the client that handles the DFS even running? Given that the login works the seconds time, unlikely.

To get to the core of this issue, it is important to understand what actually does not work. Most likely, Windows tried to CreateFile() the file named in the error message. This call failed. (You could verify this using Process Monitor.)
Why did it fail? And why doesn't it fail if you log in a second time?

The first possible cause given (Network Connectivity) seems to me to be the most reasonable. Possibly the connection to the DC is reset by the application of another group policy which won't be applied again for the second login. Or it's the other way around, only after a certain group policy has been applied can another be read from the DC.

I wonder. What happens if you try to log in a user account that shows this problem, directly on the DC?

share|improve this answer
1  
I would also look at the group policy that is mentioned, and see if you can unapply it for that computer (or for all users - depending on whether it is a computer or user GPO). If you have multiple domain controllers, maybe the one that is getting hit during logon doesn't have the GPO files (failure in FRS?). Also would check after each logon which domain controller was hit (easy way is type "set L" at command prompt). –  Shannon Wagner Feb 20 '12 at 11:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.