Group Policy does not apply across subnets????

[eastwood357]

Hello All

We have Group Policy in our domain, we have three subnets defined. 192.168.204 to 192.168.206

Thing is group policy applies when the machine is not part of any of the above subnets. add the machine to the subnet and the user part of the GPO doesnt run.

Any ideas how to fix?

Thanks

Eastwood

 

[drew1701d]

You have a router I assume, are your VLAN's configured correctly to allow Microsoft traffic to each subnet? Check out this support article for a list of ports you need to allow internally for Windows and associated service to work correctly.

http://support.microsoft.com/default.aspx?scid=kb;en-us;832017

 

[drew1701d]

heres the excerpt from the link I provided you that applies to the problem your experiencing:

Group Policy
To successfully apply Group Policy, a client must be able to contact a domain controller over the DCOM, ICMP, LDAP, SMB, and RPC protocols. If any one of these protocols are unavailable or blocked between the client and a relevant domain controller, policy will not apply or refresh. For a cross-domain logon, where a computer is in one domain, and the user account is in another, these protocols may be required for the client, the resource domain, and the account domain to communicate. ICMP is used for slow link detection. For more information about slow link detection, click the following article number to view the article in the Microsoft Knowledge Base:
227260 (

http://support.microsoft.com/kb/227260/)

How a slow link is detected for processing user profiles and Group Policy


System service name: Group Policy
Application protocol Protocol Ports
DCOM TCP + UDP random port number between 1024 - 65534
ICMP (ping) UCP 20
LDAP TCP 389
SMB TCP 445
RPC TCP 135, random port number between 1024 - 65534

 

[eastwood357]

Hi Drew

Thanks for the help, unfortunatly all ports are working fine.

I should also explain a bit more.

The machine in question (Test PC) has a 2.4.110 IP addy. Add that address to the sites and services subnet and it stop receiving GPO. Take it out and its all good.

Now caputering teh frames leads me to see how it talks when in the subnet and out.

When in it talks only to DC, and then seems to time out.

When out it talks to DC and a sqlServer where our redirect menu's sit, then goes back to DC to get GPO.

i am now wondering what my next step is going to be, i am trying to find out why when the pc is in subnet it doesnt talk to the sqlserver.

Thanks for you help once again