| Author | Messages | |
klas9574
Posts:24
 | | 02/19/2009 4:56 PM |
| We have a share and printer setup for several users having to do with an ancient LoB app. The "printers" are print to text, which is saved to the applicable share for each user. The naming convention for each is like lobprn<username> for the printer and lobfld<username> for the shared directory . I'd like to only have to setup a single GPP item for each if possible, which would be where environmental variable usage comes in. So, when setting these up using GPP, can I:
For drive mapping, set something like \\server\lobfld%username% for the location and the same sort of thing for the printer? If this will work, do I have the correct syntax for an object (shared printer or folder) with a name that is a combination of static text and a variable?
Thanks,
Scott Klassen
From: Darren Mar-Elia
Sent: Wednesday, February 18, 2009 3:45 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Fascinating! And now it makes complete sense. That service is used by Windows to resolve DFS names (e.g. \\domain\sysvol) to NetBIOS names \\DC1\sysvol). I've seen GP Processing fail when that service is stopped but I've not seen the effect in GPMC that you were seeing, but it totally makes sense! Thanks for reporting back Ken. I think we all learned something today!
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 1:20 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
I found the Problem, Now I have to find out why. TCP/IP NetBIOS Helper service was not started, although it was set to automatic. Once I started that the policy opened up just fine.
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Delaney, Doug
Sent: Wednesday, February 18, 2009 3:04 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
make sure the "server" service is running on the DC.
Doug Delaney
Infrastructure Specialist - Integration Engineering-GM
EDS, an HP company
GM Desktop Engineering
985 W. Entrance Dr. 2150
Auburn Hills, MI 48326
Lab: +1 248-365-9187
Tel: +1 248 754-7917
Pg: +1 248 870-0306
Mobile: +1 248 210-4973
E-mail: xxxxxxxxxxxxxxxx
We deliver on our commitments
so you can deliver on yours.
------------------------------------------------------------------------------
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Cruz, Jerome L
Sent: Wednesday, February 18, 2009 3:51 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Ken. if you were not there already. go down to the Group Policy Objects node in the GPMC (near the bottom). Look for your GPO there and click on it there in the left-hand pane. If there are SYSVOL permission issues, it'll prompt you to 'correct' them.
Jerry Cruz | Group Policies Product Manager | Windows Infrastructure Architecture | CNO | Boeing IT
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 12:42 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Ok here's a screen shot of the delegation tab
The dumpgpoinfo.wsf script just came back to a command prompt. No printout
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Darren Mar-Elia
Sent: Wednesday, February 18, 2009 1:52 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
OK. Running out of ideas. One more. Can you output the permissions on that GPO? And post here? You can use dumpGPOInfo.wsf from the GPMC scripts or even a screen shot from GPMC on the Delegation tab, if you can get to it.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 11:36 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
All Settings seem to be correct in adsiedit. If I try to edit the policy I get:
Then the editor opens but the tree has a red X
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Darren Mar-Elia
Sent: Wednesday, February 18, 2009 1:16 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Ok. Do you get that semaphore error on GP Editor as well? Can you backup the GPO using GPMC backup? Also, not sure if you're comfortable with it, but can you go into AD using AD Users or Computers or ADSIEdit and open the GUID-named container for that GPO under CN=Policies,CN=System. Check that the permissions on that container roughly correspond to the SYSVOL permissions. Check that the attribute called gpcFileSysPath points to the UNC path for the SYSVOL portion of the GPO. Let me know what you find.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 11:03 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Unable to edit that particular policy.
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Darren Mar-Elia
Sent: Wednesday, February 18, 2009 12:47 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Ken-
At least on the surface, I don't see anything wrong with the contents of that folder below, that would cause GPMC to report SYSVOL as being unavailable. Are you able to edit the GPO (i.e. launch GP Editor)? If so, you might want to just open the GP Editor on that GPO, make a small change, apply it, then back it out, and see if that cleans up the issue.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 10:33 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
This is a Small Business Server 2003 only one server. The comparison I made was another customers system.
See image for machine folder contents
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Darren Mar-Elia
Sent: Wednesday, February 18, 2009 11:44 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
So is it only one machine where you see the errors? Also, when you drill into the GUID-named folder, what do you see under the Machine folder?
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 9:21 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Yes the sysvol path, guid, all have the correct permissions. (all compared to another server)
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Darren Mar-Elia
Sent: Wednesday, February 18, 2009 11:12 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Ken-
It looks like that GPMC can either not find or cannot read the contents of the SYSVOL portion of the GPO. On your DC (assuming you only have one) can you verify that under \\domain name\sysvol\domainname\policies, that there is a folder name for the GUID of that GPO, that the folder has files in it and that the permissions on the folder allow at least Authenticated Users the ability to read it?
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 7:21 AM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
I have a customer that has Small Business Server 2003 SP2 installed. I'm getting userenv errors in the app log 1030 and 1058.
When I try to open GPMC, I get a semaphore timeout, then it opens. I think I have a corrupt Domain Password Policy. See Picture.
The other policies open up just fine. How can I fix this?
| | | |
| Darren
Posts:103
| | 02/19/2009 6:23 PM |
| Scott-
Off the top of my head, I don't believe GPP will resolve those environment
variables on the client. I could be wrong and admit to not having tested it
but I have never seen that approach discussed. I guess ultimately you will
probably need to test it but I would be surprised if it worked. Another
approach you can take is to create a drive mapping for each different
printer and share combination ( assuming that isn't a huge number) and then
use item-level-targeting by environment variables to filter the application
of those mappings.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Scott Klassen
Sent: Thursday, February 19, 2009 1:48 PM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] GPP Drive and Printer mapping and environmental vaiables
We have a share and printer setup for several users having to do with an
ancient LoB app. The "printers" are print to text, which is saved to the
applicable share for each user. The naming convention for each is like
lobprn<username> for the printer and lobfld<username> for the shared
directory . I'd like to only have to setup a single GPP item for each if
possible, which would be where environmental variable usage comes in. So,
when setting these up using GPP, can I:
For drive mapping, set something like \\server\lobfld%username%
<file:///\\server\lobfld%25username%25> for the location and the same sort
of thing for the printer? If this will work, do I have the correct syntax
for an object (shared printer or folder) with a name that is a combination
of static text and a variable?
Thanks,
Scott Klassen
From: Darren <mailto:xxxxxxxxxxxxxxxx> Mar-Elia
Sent: Wednesday, February 18, 2009 3:45 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Fascinating! And now it makes complete sense. That service is used by
Windows to resolve DFS names (e.g. \\domain\sysvol <file:///\\domain\sysvol>
) to NetBIOS names \\DC1\sysvol <file:///\\DC1\sysvol> ). I've seen GP
Processing fail when that service is stopped but I've not seen the effect in
GPMC that you were seeing, but it totally makes sense! Thanks for reporting
back Ken. I think we all learned something today!
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 1:20 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
I found the Problem, Now I have to find out why. TCP/IP NetBIOS Helper
service was not started, although it was set to automatic. Once I started
that the policy opened up just fine.
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Delaney, Doug
Sent: Wednesday, February 18, 2009 3:04 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
make sure the "server" service is running on the DC.
Doug Delaney
Infrastructure Specialist - Integration Engineering-GM
EDS, an HP company
GM Desktop Engineering
985 W. Entrance Dr. 2150
Auburn Hills, MI 48326
Lab: +1 248-365-9187
Tel: +1 248 754-7917
Pg: +1 248 870-0306
Mobile: +1 248 210-4973
E-mail: <mailto xxxxxxxxxxxxxxxx> xxxxxxxxxxxxxxxx
We deliver on our commitments
so you can deliver on yours.
_____
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Cruz, Jerome L
Sent: Wednesday, February 18, 2009 3:51 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Ken. if you were not there already. go down to the Group Policy Objects node
in the GPMC (near the bottom). Look for your GPO there and click on it there
in the left-hand pane. If there are SYSVOL permission issues, it'll prompt
you to 'correct' them.
Jerry Cruz | Group Policies Product Manager | Windows Infrastructure
Architecture | CNO | Boeing IT
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 12:42 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Ok here's a screen shot of the delegation tab
The dumpgpoinfo.wsf script just came back to a command prompt. No printout
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Darren Mar-Elia
Sent: Wednesday, February 18, 2009 1:52 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
OK. Running out of ideas. One more. Can you output the permissions on that
GPO? And post here? You can use dumpGPOInfo.wsf from the GPMC scripts or
even a screen shot from GPMC on the Delegation tab, if you can get to it.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 11:36 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
All Settings seem to be correct in adsiedit. If I try to edit the policy I
get:
Then the editor opens but the tree has a red X
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Darren Mar-Elia
Sent: Wednesday, February 18, 2009 1:16 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Ok. Do you get that semaphore error on GP Editor as well? Can you backup the
GPO using GPMC backup? Also, not sure if you're comfortable with it, but can
you go into AD using AD Users or Computers or ADSIEdit and open the
GUID-named container for that GPO under CN=Policies,CN=System. Check that
the permissions on that container roughly correspond to the SYSVOL
permissions. Check that the attribute called gpcFileSysPath points to the
UNC path for the SYSVOL portion of the GPO. Let me know what you find.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 11:03 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Unable to edit that particular policy.
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Darren Mar-Elia
Sent: Wednesday, February 18, 2009 12:47 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Ken-
At least on the surface, I don't see anything wrong with the contents of
that folder below, that would cause GPMC to report SYSVOL as being
unavailable. Are you able to edit the GPO (i.e. launch GP Editor)? If so,
you might want to just open the GP Editor on that GPO, make a small change,
apply it, then back it out, and see if that cleans up the issue.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 10:33 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
This is a Small Business Server 2003 only one server. The comparison I made
was another customers system.
See image for machine folder contents
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Darren Mar-Elia
Sent: Wednesday, February 18, 2009 11:44 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
So is it only one machine where you see the errors? Also, when you drill
into the GUID-named folder, what do you see under the Machine folder?
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 9:21 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Yes the sysvol path, guid, all have the correct permissions. (all compared
to another server)
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Darren Mar-Elia
Sent: Wednesday, February 18, 2009 11:12 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
Ken-
It looks like that GPMC can either not find or cannot read the contents of
the SYSVOL portion of the GPO. On your DC (assuming you only have one) can
you verify that under \\domain name\sysvol\domainname\policies, that there
is a folder name for the GUID of that GPO, that the folder has files in it
and that the permissions on the folder allow at least Authenticated Users
the ability to read it?
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Ken Taczala
Sent: Wednesday, February 18, 2009 7:21 AM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] Event Errors 1030 & 1058 Corrupt GPO?
I have a customer that has Small Business Server 2003 SP2 installed. I'm
getting userenv errors in the app log 1030 and 1058.
When I try to open GPMC, I get a semaphore timeout, then it opens. I think
I have a corrupt Domain Password Policy. See Picture.
The other policies open up just fine. How can I fix this?
| | | |
| RobertMariani
Posts:36
| | 02/19/2009 6:54 PM |
| GPP does resolve environmental variables.
While I have not specifically used it for printers, I do use it to map a
mail archive drive and others for a user - as attached
The catch with it working is to ensure you get the right setting in the
options with "Run in logged-on user's security context (user policy
option)" Yes/No. I believe this will ensure the %username% is resolved
correctly
Regards,
Robert Mariani
Applications Manager
--
The Buchan Group, Melbourne
Architecture+Master Planning+Interiors+Graphics
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Darren Mar-Elia
Sent: Friday, 20 February 2009 10:18 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] GPP Drive and Printer mapping and environmental
vaiables
Scott-
Off the top of my head, I don't believe GPP will resolve those
environment variables on the client. I could be wrong and admit to not
having tested it but I have never seen that approach discussed. I guess
ultimately you will probably need to test it but I would be surprised if
it worked. Another approach you can take is to create a drive mapping
for each different printer and share combination ( assuming that isn't a
huge number) and then use item-level-targeting by environment variables
to filter the application of those mappings.
Darren
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Scott Klassen
Sent: Thursday, February 19, 2009 1:48 PM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] GPP Drive and Printer mapping and environmental
vaiables
We have a share and printer setup for several users having to do with an
ancient LoB app. The "printers" are print to text, which is saved to
the applicable share for each user. The naming convention for each is
like lobprn<username> for the printer and lobfld<username> for the
shared directory . I'd like to only have to setup a single GPP item for
each if possible, which would be where environmental variable usage
comes in. So, when setting these up using GPP, can I:
For drive mapping, set something like \\server\lobfld%username%
<file:///\\server\lobfld%25username%25> for the location and the same
sort of thing for the printer? If this will work, do I have the correct
syntax for an object (shared printer or folder) with a name that is a
combination of static text and a variable?
Thanks,
Scott Klassen
| | | |
| Darren
Posts:103
| | 02/19/2009 7:06 PM |
| That's great info Robert! Thanks!
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Robert Mariani
Sent: Thursday, February 19, 2009 3:49 PM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] GPP Drive and Printer mapping and environmental
vaiables
GPP does resolve environmental variables.
While I have not specifically used it for printers, I do use it to map a
mail archive drive and others for a user - as attached
The catch with it working is to ensure you get the right setting in the
options with "Run in logged-on user's security context (user policy option)"
Yes/No. I believe this will ensure the %username% is resolved correctly
Regards,
Robert Mariani
Applications Manager
--
The Buchan Group, Melbourne
Architecture+Master Planning+Interiors+Graphics
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Darren Mar-Elia
Sent: Friday, 20 February 2009 10:18 AM
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] GPP Drive and Printer mapping and environmental
vaiables
Scott-
Off the top of my head, I don't believe GPP will resolve those environment
variables on the client. I could be wrong and admit to not having tested it
but I have never seen that approach discussed. I guess ultimately you will
probably need to test it but I would be surprised if it worked. Another
approach you can take is to create a drive mapping for each different
printer and share combination ( assuming that isn't a huge number) and then
use item-level-targeting by environment variables to filter the application
of those mappings.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Scott Klassen
Sent: Thursday, February 19, 2009 1:48 PM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] GPP Drive and Printer mapping and environmental vaiables
We have a share and printer setup for several users having to do with an
ancient LoB app. The "printers" are print to text, which is saved to the
applicable share for each user. The naming convention for each is like
lobprn<username> for the printer and lobfld<username> for the shared
directory . I'd like to only have to setup a single GPP item for each if
possible, which would be where environmental variable usage comes in. So,
when setting these up using GPP, can I:
For drive mapping, set something like \\server\lobfld%username%
<file:///\\server\lobfld%25username%25> for the location and the same sort
of thing for the printer? If this will work, do I have the correct syntax
for an object (shared printer or folder) with a name that is a combination
of static text and a variable?
Thanks,
Scott Klassen
| | | |
|
|