Windows 2000 Policy

[racer514]

I think we have a problem with 2000 policy.
It's a win2k Domain Controller, one other win2k server, and the rest are NT4.0, 98, and 95. Windows 2000 pro machines trying to log into the network are taking forever. My boss thinks it is from a policy problem because we cannot access the policy snap-in.. I looked through some articles in Microsofts database and found some information but not enough to gove me th econfidence to try to repair it. In the following article MS talks about editing a policy folder.

http://support.microsoft.com/suppor...00&rnk=119&src=DHCS_MSPSS_gn_SRCH&SPR=WIN2000

I looked on our domain controller and that file does not exist. It stops a few directories before. The other GUID has a policy but not eh one MS suggests the problem may be with. This would explain why the logon times are so long. If that policy file is for 2000 workstations than they will take a long time because they are looking for the policies and tehy aren't there. Does anyone have any help for this. You could make me a hero.

 

[TheOtherKiwi]

If you logon to the console of the domain controller, can you run the GPO MMC?

If not then I would try installing the Administration tool from the server CDROM (double-click ADMIN.MSI) and then try.

Can the win2k pro machine login locally and then connect to shares quickly. If so, then this may point to a logon problem other then GPO's.

 

[racer514]

If you log on locally, I assume not to the domain but to the machine itself, how would you be able to connect to shares on the network (which is a domain). Not being sarcastic, really want to know. I cannot run the GPO program MMC. What is the admin tool for?

 

[TheOtherKiwi]

Any domain member server or DC can run the GPO snap-in as long as you can authenticate yourself to the domain either at logon time or later when you actually connect to a server. However, in this case as the machine is a DC then the MMC should run on the local machine (albeit using a database distributed amongst the DCs on your domain).

Logon locally, or not it doesn't matter, click Start Menu run, type MMC, click Console menu and choose Add/Remove Snap-in, click the Add button, scroll down to the Group Policy object and click OK, accept Local Computer by clicking the Finish button or (mor likely) select Browse and find the server(s) you need to connect to (itself shouold be fine if it is a valid DC). click Close, click OK. You are there!

If you have no Group Policy object from the list of objects to choose from, then you need to run the ADMIN.MSI as above or maybe add the support tools, I can't remember which but I believe it is in the Win2k help somewhere.

 

[racer514]

There is a Group Policy object from the list of objects,
BUT.....no domain controller can be found.

Why is DNS starting to sound like the problem. It also may explain the even id 1001 and 1000 I am getting.???MAybe, what do ya think??

 

[TheOtherKiwi]

Yeah, totally. Try using NSLOOKUP at the command line (see windows help) to resolve names and ip addresses to your current DNS server. How is the DNS server configured? Is it on the DC or the other server? Can you resolve each win2k server name from itself to the dns server?