Navigation

    ML
    • Register
    • Login
    • Search
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups

    Group Policy isn't working after Ransomware Attack

    IT Discussion
    9
    36
    604
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • wirestyle22
      wirestyle22 last edited by wirestyle22

      We've rebuilt all of our domain controllers after we got hit with ransomware. A pretty big metadata cleanup needs to occur.

      I ran gpupdate /force to see what errors it threw out

      The processing of Group Policy failed. Windows attempted to read the file \\Domain.local\SysVol\Domain.local\Policies\{unique identifier}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
User Policy could not be updated successfully. The following errors were encountered:

      There are some shares in sysvol that don't exist anymore upon our restore. Would that cause the entirety of group policy to shutdown or just the application of said GPO's that are being referenced?

      1 Reply Last reply Reply Quote 0
      • wirestyle22
        wirestyle22 last edited by wirestyle22

        repadmin /showrepl came back successful for all
        repadmin /syncall was successful for all
        repadmin /kcc was successful

        1 Reply Last reply Reply Quote 0
        • Dashrender
          Dashrender last edited by

          you mean you didn't just kill the old domain and make a new one?

          1 Reply Last reply Reply Quote 0
          • coliver
            coliver last edited by

            Did you ensure the Group Policy client was enabled and started on the workstation you are testing on?

            wirestyle22 1 Reply Last reply Reply Quote 0
            • coliver
              coliver last edited by

              Could also be a permissions issue on the folders/locations that are referenced.

              1 Reply Last reply Reply Quote 0
              • wirestyle22
                wirestyle22 @coliver last edited by

                @coliver said in Group Policy isn't working after Ransomware Attack:

                Did you ensure the Group Policy client was enabled and started on the workstation you are testing on?

                Yes I did

                1 Reply Last reply Reply Quote 0
                • wirestyle22
                  wirestyle22 last edited by

                  I resolve the above and now I am getting the below error:

                  The following warnings were encountered during computer policy processing:

Windows failed to apply the Scripts settings. Scripts settings might have its own log file. Please click on the "More information" link.
Windows failed to apply the Internet Explorer Zonemapping settings. Internet Explorer Zonemapping settings might have its own log file. Please click on the "More information" link.
User Policy update has completed successfully.

The following warnings were encountered during user policy processing:

The Group Policy Client Side Extension Folder Redirection was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.

For more detailed information, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.

Certain user policies are enabled that can only run during logon.

OK to log off? (Y/N)
                  1 Reply Last reply Reply Quote 0
                  • wirestyle22
                    wirestyle22 last edited by wirestyle22

                    mismatch.png

                    mismatch2.png

                    mismatch3.png

                    J 1 Reply Last reply Reply Quote 0
                    • J
                      JasGot @wirestyle22 last edited by

                      @wirestyle22 said in Group Policy isn't working after Ransomware Attack:

                      mismatch.png

                      How many DCs?

                      wirestyle22 1 Reply Last reply Reply Quote 0
                      • wirestyle22
                        wirestyle22 @JasGot last edited by

                        @JasGot said in Group Policy isn't working after Ransomware Attack:

                        @wirestyle22 said in Group Policy isn't working after Ransomware Attack:

                        mismatch.png

                        How many DCs?

                        lol.

                        like 30+

                        dafyre 1 Reply Last reply Reply Quote 0
                        • wirestyle22
                          wirestyle22 last edited by

                          Right now I am working on a script to compare all of the files contained within sysvol between all dc's

                          1 Reply Last reply Reply Quote 0
                          • dafyre
                            dafyre @wirestyle22 last edited by

                            @wirestyle22 said in Group Policy isn't working after Ransomware Attack:

                            @JasGot said in Group Policy isn't working after Ransomware Attack:

                            @wirestyle22 said in Group Policy isn't working after Ransomware Attack:

                            mismatch.png

                            How many DCs?

                            lol.

                            like 30+

                            30 AD Domain controllers?

                            wirestyle22 1 Reply Last reply Reply Quote 0
                            • wirestyle22
                              wirestyle22 @dafyre last edited by

                              @dafyre said in Group Policy isn't working after Ransomware Attack:

                              @wirestyle22 said in Group Policy isn't working after Ransomware Attack:

                              @JasGot said in Group Policy isn't working after Ransomware Attack:

                              @wirestyle22 said in Group Policy isn't working after Ransomware Attack:

                              mismatch.png

                              How many DCs?

                              lol.

                              like 30+

                              30 AD Domain controllers?

                              Over 30

                              J 1 Reply Last reply Reply Quote 0
                              • J
                                JasGot @wirestyle22 last edited by

                                @wirestyle22 Problems with all of them? or just the one(s) that was/were hit with Ransomware?

                                wirestyle22 1 Reply Last reply Reply Quote 0
                                • wirestyle22
                                  wirestyle22 @JasGot last edited by

                                  @JasGot said in Group Policy isn't working after Ransomware Attack:

                                  @wirestyle22 Problems with all of them? or just the one(s) that was/were hit with Ransomware?

                                  Everything has the same error including workstations when you gpupdate

                                  1 Reply Last reply Reply Quote 0
                                  • dafyre
                                    dafyre last edited by

                                    This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?

                                    wrx7m 1 Reply Last reply Reply Quote 1
                                    • wrx7m
                                      wrx7m @dafyre last edited by

                                      @dafyre said in Group Policy isn't working after Ransomware Attack:

                                      This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?

                                      Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.

                                      dafyre Dashrender 2 Replies Last reply Reply Quote 5
                                      • dafyre
                                        dafyre @wrx7m last edited by

                                        @wrx7m said in Group Policy isn't working after Ransomware Attack:

                                        @dafyre said in Group Policy isn't working after Ransomware Attack:

                                        This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?

                                        Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.

                                        Nuke and pave is always a good answer... but jeez... Why do you need so many DCs to start with?

                                        Our AD infrastructure here has nearly 40k people in it and we only have 6.

                                        wirestyle22 1 Reply Last reply Reply Quote 1
                                        • Dashrender
                                          Dashrender @wrx7m last edited by

                                          @wrx7m said in Group Policy isn't working after Ransomware Attack:

                                          @dafyre said in Group Policy isn't working after Ransomware Attack:

                                          This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?

                                          Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.

                                          huh - who asked about that earlier? ;)

                                          1 Reply Last reply Reply Quote 0
                                          • wirestyle22
                                            wirestyle22 @dafyre last edited by

                                            @dafyre said in Group Policy isn't working after Ransomware Attack:

                                            @wrx7m said in Group Policy isn't working after Ransomware Attack:

                                            @dafyre said in Group Policy isn't working after Ransomware Attack:

                                            This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?

                                            Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.

                                            Nuke and pave is always a good answer... but jeez... Why do you need so many DCs to start with?

                                            Our AD infrastructure here has nearly 40k people in it and we only have 6.

                                            We ask that question every day

                                            Dashrender 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post