server 2003 help: event id 1030 & 1058

[troyquigley]

i have 2 new freshly installed 2003 servers - trying to finish them up.
when i go into "group policy management" and right click on "default domain policy" i get this error

"failed to open the group policy object. you may not have appropriate rights."
"the network path was not found"

then i go and check even viewer and this is what i get

event id 1030
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.


event id 1058
Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mimsdist,DC=
ocal. The file must be present at the location CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=mimsdist,DC=
ocal.<\\mimsdist.local\sysvol\mimsdist.local\Policies\{31B2F340-016D-11D2-945F-00
04FB984F9}\gpt.ini>. (The network path was not found. ). Group Policy processing aborted.

BTW - i get the exact same error on both 2003 servers

 

[stash]

DNS?

Do you have DNS running on either or both of tese servers? Are you pointing the servers to themselves for DNS?

 

[troyquigley]

yes. both servers are running DNS.
and i have this for each server
primary dns server: 192.168.0.254
2nd dns server: 192.168.0.253

 

[stash]

What is your domain name? I see mimsdist. and then dc=<blank> Do you have mimsdist.something, or is it a single-label domain?

If you ping your domain name from either server, does it return the IP of one of the DCs?

 

[troyquigley]

my domain name is "mimsdist.local"

if i ping "mimsdist.local" i get a ping response with the ip address of one of my dns servers

PS
i just did this
start: run:
\\mimsdist.local\sysvol\mimsdist.local\Policies\{31B2F340-016D-11D2-945F-00
04FB984F9}\gpt.ini

to make sure the path and everything is ok. and i get this error
"no network provider accepted the given network path."

i have gone and i made sure that the path is valid
\\192.168.0.254\c$\WINDOWS\SYSVOL\sysvol\mimsdist.local\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}
that is a valid path

 

[stash]

Hmm, could be an access issue. Have you modified any of the policy settings? Esepcially security settings, like access this computer from the network? Is this a 2003 SP1 server, and does it have the firewall turned on?

If you try to go to start-->run-->\\mimsdist.local, what happens? What about \\server1.mimsdist.local? (where server1 is one of your DCs).

Are these server multihomed?

 

[troyquigley]

i have not modified any policy settings.
it is server 2003 sp1
windows firewall is not running, because i disabled the service that would let it run

if i run \\mimsdist.local
i get this "no network provider accepted the given network path"

if i run \\mimsdca\mimsdist.local
i get this "no network provider accepted the given network path"

if i run \\mimsdca
i get it work go there fine - so that works

 

[stash]

because i disabled the service that would let it run

Did you disable any other services?

 

[troyquigley]

yes

APPLICATION EXPERIENCE LOOKUP SERVICE: SET TO "DISABLED"
COMPUTER BROWSER: SET TO "DISABLED"
DHCP CLIENT: SET TO "DISABLED"
ERROR REPORTING SERVICE: SET TO "DISABLED"
NETWORK LOCATION AWARENESS (NLA) : SET TO "DISABLED"
SHELL HARDWARE DETECTION: SET TO "DISABLED"
TCP/IP NETBIOS HELPER: SET TO "DISABLED"
WIRELESS CONFIGURATION: SET TO "DISABLED"

 

[stash]

TCP/IP netbios helper is what is breaking this, but you also need to enable DHCP client.

Both should be set to auto and started.

 

[troyquigley]

YOUR KIDDING ME !
why would it need dhcp client - if it is a dhcp server ?
why does it need netbios helper ?

BTW - if you are right - you are my HERO !!

 

[stash]

DHCP client is needed to register records in DNS. Yes, that sounds weird, but that's the way it works. http://support.microsoft.com/kb/264539/EN-US/

TCP/IP Netbios Helper service is used to provide netbios name resolution to tcp/ip services, and it also does DNS name resolution.

 

[troyquigley]

thank you !
thank you soooo much !
i might be able to sleep tonight - woot

 

[troyquigley]

ok - one last question then - regarding services

do i need these services running to login and work on a Domain ?

dns client
messenger
network location awareness
remote access connection manager
shell hardware detection
telephony
windows image aquisition

all workstation use LAN for internet
i have all the above servies set to "disabled" in my setup procedure - should i set any of them to "automatic".
i hate having services running that i rreally dont need - im a TWEAKER

 

[stash]

Tweaking doesn't have a place on a business network, if that's what this is. People need the network to work.

Not that you shouldn't be concerned about reducing your attack surface by disabling unnecessary services. You just need to be smart about it. So, I would recommend reading the XP Security Guide, the 2003 Security Guide and the 2003 Threats and Countermeasures Guide.

http://www.microsoft.com/technet/securi...odtech/windowsxp/secwinxp/default.mspx
http://www.microsoft.com/technet/securi.../windowsserver2003/w2003hg/sgch00.mspx
http://www.microsoft.com/technet/security/topics/Serversecurity/tcg/tcgch00.mspx

 

[EPCrew]

just fyi... i was racking my brains with this one for a good part of the day. everything mentioned here and on technet appeared to be ok. just rebooted my DCs and i was able to run gpupdate /force successfully from the client afterwards.