Windows cannot query for the list of group policy objects
Вопрос
I am getting the following SCOM alert about “Active Directory GPO lookup failure” from one of our domain controllers (dc-server1) that is running on Windows Server 2003 OS. The rest of domain controllers are on Windows 2008 and 2012 (domain functional level is 2003). I did enable UserEnv logging and attaching the userenv.log that I captured. Also attaching the events that appear to be relevant in the event logs on dc-server1.
I have a suspicion that this could be caused by another issue that we are experiencing, but not 100% sure, hence wanted to ask you to confirm. The other issue is: we have a domain account called «stuffadmin» which get locked up every 10 minutes or so. Most likely there is a job or service running somewhere that has an old password for this account and it is locking the account with bad password requests. I tried to track it. From PDC (p-dc1) I traced it to the domain controller above (dc-server1), and from there to a a server that is running «E:\Program Files (x86)\Spiceworks\spiceworks_desktop.exe» among other things. I wasn’t able to find the exact process or program that is trying to use that account. some of the event logs from below complain about that specific account at the same time that the SCOM error was issued.
The SCOM alert and event logs are below, and userenv.log and userenv.bak can by downloaded by clicking on their names.
Alerts and Event Logs:
Machine account policy failure — Active Directory GPO lookup failure
Alert Description
Source: dc-server1
Full Path Name: dc-server1.TheCompany.com\dc-server1
Alert Rule: Machine account policy failure — Active Directory GPO lookup failure
Created: 5/5/2016 3:20:52 PM
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.
Knowledge: View additional knowledge.
Summary
UserEnv experienced an error applying Group Policy to the domain controller. Group Policy must be applied successfully for domain controllers to function properly because domain controllers get several critical permissions, such as Access this computer from network, through policy. Because of the architecture of UserEnv, Microsoft Operations Manager (MOM) is unable to directly report the specific problem.
Sample Event: Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.
Causes: This may indicate that the Active Directory® directory service has failed. Problems with replication are the main cause of this error.
Resolutions
To enable UserEnv logging, see Knowledge Base article 221833, “How to Enable User Environment Debug Logging in Retail Builds of Windows,” at http://go.microsoft.com/fwlink/?LinkId=25636. The log file provides details for the specific error.
External Knowledge Sources
• Microsoft Help and Support for Microsoft Windows Server 2003
• Microsoft Knowledge Base
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 5/5/2016
Time: 3:20:52 PM
User: TheCompany\stuffadmin
Computer: dc-server1
Description:
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1058
Date: 5/5/2016
Time: 3:20:52 PM
User: TheCompany\stuffadmin
Computer: dc-server1
Description:
Windows cannot access the file gpt.ini for GPO cn=
— System Log —
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 5/5/2016
Time: 3:20:52 PM
User: N/A
Computer: dc-server1
Description:
The Security System detected an authentication error for the server cifs/p-dc1.TheCompany.com. The failure code from authentication protocol Kerberos was «The referenced account is currently disabled and may not be logged on to.
(0xc0000072)».
Data:
0000: 72 00 00 c0 r..À
— Directory Service Log —
Event Type: Warning
Event Source: NTDS Replication
Event Category: Replication
Event ID: 1083
Date: 5/5/2016
Time: 3:35:58 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: dc-server1
Description:
Active Directory could not update the following object with changes received from the domain controller at the following network address because Active Directory was busy processing information.
Windows cannot query for the list of group policy objects
The following forum(s) have migrated to Microsoft Q&A: All English Windows Server forums!
Visit Microsoft Q&A to post new questions.
Answered by:
Question
I am getting the following SCOM alert about “Active Directory GPO lookup failure” from one of our domain controllers (dc-server1) that is running on Windows Server 2003 OS. The rest of domain controllers are on Windows 2008 and 2012 (domain functional level is 2003). I did enable UserEnv logging and attaching the userenv.log that I captured. Also attaching the events that appear to be relevant in the event logs on dc-server1.
I have a suspicion that this could be caused by another issue that we are experiencing, but not 100% sure, hence wanted to ask you to confirm. The other issue is: we have a domain account called «stuffadmin» which get locked up every 10 minutes or so. Most likely there is a job or service running somewhere that has an old password for this account and it is locking the account with bad password requests. I tried to track it. From PDC (p-dc1) I traced it to the domain controller above (dc-server1), and from there to a a server that is running «E:\Program Files (x86)\Spiceworks\spiceworks_desktop.exe» among other things. I wasn’t able to find the exact process or program that is trying to use that account. some of the event logs from below complain about that specific account at the same time that the SCOM error was issued.
The SCOM alert and event logs are below, and userenv.log and userenv.bak can by downloaded by clicking on their names.
Alerts and Event Logs:
Machine account policy failure — Active Directory GPO lookup failure
Alert Description
Source: dc-server1
Full Path Name: dc-server1.TheCompany.com\dc-server1
Alert Rule: Machine account policy failure — Active Directory GPO lookup failure
Created: 5/5/2016 3:20:52 PM
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.
Knowledge: View additional knowledge.
Summary
UserEnv experienced an error applying Group Policy to the domain controller. Group Policy must be applied successfully for domain controllers to function properly because domain controllers get several critical permissions, such as Access this computer from network, through policy. Because of the architecture of UserEnv, Microsoft Operations Manager (MOM) is unable to directly report the specific problem.
Sample Event: Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.
Causes: This may indicate that the Active Directory® directory service has failed. Problems with replication are the main cause of this error.
Resolutions
To enable UserEnv logging, see Knowledge Base article 221833, “How to Enable User Environment Debug Logging in Retail Builds of Windows,” at http://go.microsoft.com/fwlink/?LinkId=25636. The log file provides details for the specific error.
External Knowledge Sources
• Microsoft Help and Support for Microsoft Windows Server 2003
• Microsoft Knowledge Base
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1030
Date: 5/5/2016
Time: 3:20:52 PM
User: TheCompany\stuffadmin
Computer: dc-server1
Description:
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.
Event Type: Error
Event Source: Userenv
Event Category: None
Event ID: 1058
Date: 5/5/2016
Time: 3:20:52 PM
User: TheCompany\stuffadmin
Computer: dc-server1
Description:
Windows cannot access the file gpt.ini for GPO cn=
— System Log —
Event Type: Warning
Event Source: LSASRV
Event Category: SPNEGO (Negotiator)
Event ID: 40960
Date: 5/5/2016
Time: 3:20:52 PM
User: N/A
Computer: dc-server1
Description:
The Security System detected an authentication error for the server cifs/p-dc1.TheCompany.com. The failure code from authentication protocol Kerberos was «The referenced account is currently disabled and may not be logged on to.
(0xc0000072)».
Data:
0000: 72 00 00 c0 r..À
— Directory Service Log —
Event Type: Warning
Event Source: NTDS Replication
Event Category: Replication
Event ID: 1083
Date: 5/5/2016
Time: 3:35:58 AM
User: NT AUTHORITY\ANONYMOUS LOGON
Computer: dc-server1
Description:
Active Directory could not update the following object with changes received from the domain controller at the following network address because Active Directory was busy processing information.
Windows cannot query for the list of Group Policy objects.
Event 1030
Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.
Event 1058
Windows cannot access the file gpt.ini for GPO cn=<9E447732-A6FA-461A-971F-C293B61D1EE2>,cn=policies,cn=system,DC=domain,DC=domain,DC=com. The file must be present at the location . (Access is denied. ). Group Policy processing aborted.
Both are being logged every 5 minutes or so. I have two domain controllers, one being an Exchange 2003 server and the other a standard server with DNS/DHCP. Only being logged on the standard server however. Ironically this a new DC in the environment, its only several weeks old but had no problems prior. This started happening about 2 days ago, I’m almost positive it was after I teamed up the Broadcom NIC’s for offloading but could this really be probably cause?
I’d prefer not to change any NIC drivers yet as these Broadcom adapters tend to be very picky. I found that if I used the drivers included on the TCP/IP offload CD from Dell, the virtual adapter was able to ping out but could not be connected to. Instead I used the drivers that came on the Dell driver CD and it seems to work fine.
Anyways I have confirmed that the gpt.ini file is there with proper permissions so that it can be modified by domain controllers. Also ensured that the SYSVOL folder is being excluded from SAV scans and the DFS service is running.
I’ve searched all over and each seem to be unique situations in their own so any help would be appreciated.
Comments
I think you sort of know what caused this — probably the last thing that changed on the server, the nic teaming. I don’t know that much about the NIC teaming. Only thing I can think of offhand — the IP address of the teamed adapter, is it the same as what you were using before as the IP address?
IS DNS still running? Does the teamed adapter have DNS addresses set up?
What do you see in the Active Directory event logs?
You need to run some diagnostics on the server that is having these failures. Look into dcdiag and netdiag.
Recent: 11/2019 — RHCSA (RHEL 7); 2/2019 — Updated VCP to 6.5 (just a few days before VMware discontinued the re-cert policy. )
Working on: RHCE/Ansible
Future: Probably continued Red Hat Immersion, Possibly VCAP Design, or maybe a completely different path. Depends on job demands.
Recent: 11/2019 — RHCSA (RHEL 7); 2/2019 — Updated VCP to 6.5 (just a few days before VMware discontinued the re-cert policy. )
Working on: RHCE/Ansible
Future: Probably continued Red Hat Immersion, Possibly VCAP Design, or maybe a completely different path. Depends on job demands.
I think you sort of know what caused this — probably the last thing that changed on the server, the nic teaming. I don’t know that much about the NIC teaming. Only thing I can think of offhand — the IP address of the teamed adapter, is it the same as what you were using before as the IP address?
IS DNS still running? Does the teamed adapter have DNS addresses set up?
What do you see in the Active Directory event logs?
You need to run some diagnostics on the server that is having these failures. Look into dcdiag and netdiag.
DNS still running and pointing to localhost as a DNS server should. Everything works fine really, its just that this is flooding the event viewer and I’d like to stop it. Nothing wrong with GPOs either, they’re applying fine as they always have been.
Nothing unusual in the Directory logs, at least nothing different from before this started happening.
I saw this from eventid.net which lead me to my assumption:
I get this sometimes, and it apparently relates to DNS but the symptoms are difficult to pinpoint. Sometimes when it is happening, systems take a long time to log on to the domain. I also get messages about a DC not being found for kerberos, and sometimes file shares take a long time to open up.
For several months I have been rebooting both DC’s when the problems come up and the error goes away for a few weeks or months.
I’m also using Broadcom carts with TCP/IP Offloading. I wonder if that has something to do with it.
If you reboot your DC’s, does it go away for a while?
Make sure your permissions are correct on your GPO Objects inside this folder. Break out the GPO Administration Tool and check them that way if you prefer the user friendly names.
I had this issue a while back and I don’t remember what the hell it was, but the permissions on all the GPOs got FUBAR and had to be manually reset on every one of them. That error is sticking out as aweful familiar so I bet that is the same one I had.
Make sure your permissions are correct on your GPO Objects inside this folder. Break out the GPO Administration Tool and check them that way if you prefer the user friendly names.
I had this issue a while back and I don’t remember what the hell it was, but the permissions on all the GPOs got FUBAR and had to be manually reset on every one of them. That error is sticking out as aweful familiar so I bet that is the same one I had.
I get this sometimes, and it apparently relates to DNS but the symptoms are difficult to pinpoint. Sometimes when it is happening, systems take a long time to log on to the domain. I also get messages about a DC not being found for kerberos, and sometimes file shares take a long time to open up.
For several months I have been rebooting both DC’s when the problems come up and the error goes away for a few weeks or months.
I’m also using Broadcom carts with TCP/IP Offloading. I wonder if that has something to do with it.
If you reboot your DC’s, does it go away for a while?
make sure the ntfrs service is running.
on that local machine see if there is anything even in the policies folder. do not browse to it via the domain name. compare the policies folder on both your DCs looking for discrepancies in the contents.
make sure the ntfrs service is running.
on that local machine see if there is anything even in the policies folder. do not browse to it via the domain name. compare the policies folder on both your DCs looking for discrepancies in the contents.
I’m officially stumped. I’ve had this problem in the past. I wish I could remember what it ended up being. I’d swear it was one of the services or permissions.
File Replication Service must run to keep the policies synchronized between the DCs
dfs client must run to access the sysvol share (it is sort of a distributed file system)
permissions must be set correctly on SYSVOL share, Policies folder, and individual GPOs.
Past that I’d have to do more research than I care to since I don’t touch MS stuff anymore.
Ahhh. Don’t forget to check the NETLOGON service. 
Recent: 11/2019 — RHCSA (RHEL 7); 2/2019 — Updated VCP to 6.5 (just a few days before VMware discontinued the re-cert policy. )
Working on: RHCE/Ansible
Future: Probably continued Red Hat Immersion, Possibly VCAP Design, or maybe a completely different path. Depends on job demands.
Domain Controller Diagnosis
Performing initial setup:
Done gathering initial info.
Doing initial required tests
Testing server: Default-First-Site\NVDC
Starting test: Connectivity
. NVDC passed test Connectivity
Doing primary tests
Testing server: Default-First-Site\NVDC
Starting test: Replications
REPLICATION-RECEIVED LATENCY WARNING
NVDC: Current time is 2008-02-26 14:24:49.
CN=Schema,CN=Configuration,DC=Nature,DC=Naturesvalue,DC=com
Last replication recieved from NTSERVER at 2006-07-07 16:48:12.
WARNING: This latency is over the Tombstone Lifetime of 60 days!
CN=Configuration,DC=Nature,DC=Naturesvalue,DC=com
Last replication recieved from NTSERVER at 2006-07-07 17:05:43.
WARNING: This latency is over the Tombstone Lifetime of 60 days!
DC=Nature,DC=Naturesvalue,DC=com
Last replication recieved from NTSERVER at 2006-07-07 17:01:52.
WARNING: This latency is over the Tombstone Lifetime of 60 days!
. NVDC passed test Replications
Starting test: NCSecDesc
. NVDC passed test NCSecDesc
Starting test: NetLogons
. NVDC passed test NetLogons
Starting test: Advertising
. NVDC passed test Advertising
Starting test: KnowsOfRoleHolders
. NVDC passed test KnowsOfRoleHolders
Starting test: RidManager
. NVDC passed test RidManager
Starting test: MachineAccount
. NVDC passed test MachineAccount
Starting test: Services
. NVDC passed test Services
Starting test: ObjectsReplicated
. NVDC passed test ObjectsReplicated
Starting test: frssysvol
. NVDC passed test frssysvol
Starting test: frsevent
There are warning or error events within the last 24 hours after the
SYSVOL has been shared. Failing SYSVOL replication problems may cause
Group Policy problems.
. NVDC failed test frsevent
Starting test: kccevent
. NVDC passed test kccevent
Starting test: systemlog
An Error Event occured. EventID: 0x00000457
Time Generated: 02/26/2008 14:18:09
(Event String could not be retrieved)
An Error Event occured. EventID: 0x00000457
Time Generated: 02/26/2008 14:18:09
(Event String could not be retrieved)
An Error Event occured. EventID: 0x00000457
Time Generated: 02/26/2008 14:18:09
(Event String could not be retrieved)
An Error Event occured. EventID: 0x00000457
Time Generated: 02/26/2008 14:18:10
(Event String could not be retrieved)
An Error Event occured. EventID: 0x00000457
Time Generated: 02/26/2008 14:18:10
(Event String could not be retrieved)
. NVDC failed test systemlog
Starting test: VerifyReferences
. NVDC passed test VerifyReferences
Running partition tests on : ForestDnsZones
Starting test: CrossRefValidation
. ForestDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
. ForestDnsZones passed test CheckSDRefDom
Running partition tests on : DomainDnsZones
Starting test: CrossRefValidation
. DomainDnsZones passed test CrossRefValidation
Starting test: CheckSDRefDom
. DomainDnsZones passed test CheckSDRefDom
Running partition tests on : Schema
Starting test: CrossRefValidation
. Schema passed test CrossRefValidation
Starting test: CheckSDRefDom
. Schema passed test CheckSDRefDom
Running partition tests on : Configuration
Starting test: CrossRefValidation
. Configuration passed test CrossRefValidation
Starting test: CheckSDRefDom
. Configuration passed test CheckSDRefDom
Running partition tests on : Nature
Starting test: CrossRefValidation
. Nature passed test CrossRefValidation
Starting test: CheckSDRefDom
. Nature passed test CheckSDRefDom
Running enterprise tests on : Nature.Naturesvalue.com
Starting test: Intersite
. Nature.Naturesvalue.com passed test Intersite
Starting test: FsmoCheck
. Nature.Naturesvalue.com passed test FsmoCheck
I think you can use ntdsutil to blow that tombstoned DC away.
Won’t fix your problem but at least you get to KILL something, as I’m sure you want to right about now.
Domain: Nature.Naturesvalue.com
Validating DCs.
Available DCs:
exchange.Nature.Naturesvalue.com
nvdc.Nature.Naturesvalue.com
Searching for policies.
Found 6 policies
============================================================
Policy <2FC04055-BEEB-4E64-90AB-4F40923D99A0>
Friendly name: Microbiology
Policy OK
Details: DC: exchange.Nature.Naturesvalue.com
Friendly name: Microbiology
Created: 12/5/2007 10:38:46 PM
Changed: 2/25/2008 5:33:29 PM
DS version: 0(user) 12(machine)
Sysvol version: 0(user) 12(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: not found
Machine extensions: [<35378EAC-683F-11D2-A89A-00C04FBBCFA2> <0F6B957D-509E-11D1-A
7CC-0000F87571E3>]
Functionality version: 2 DC: nvdc.Nature.Naturesvalue.com
Friendly name: Microbiology
Created: 12/5/2007 10:38:46 PM
Changed: 2/25/2008 5:33:13 PM
DS version: 0(user) 12(machine)
Sysvol version: 0(user) 12(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: not found
Machine extensions: [<35378EAC-683F-11D2-A89A-00C04FBBCFA2> <0F6B957D-509E-11D1-A
7CC-0000F87571E3>]
Functionality version: 2 ============================================================
Policy <31B2F340-016D-11D2-945F-00C04FB984F9>
Friendly name: Default Domain Policy
Policy OK
Details: DC: exchange.Nature.Naturesvalue.com
Friendly name: Default Domain Policy
Created: 4/7/2000 5:49:19 PM
Changed: 2/25/2008 7:37:56 PM
DS version: 1(user) 23(machine)
Sysvol version: 1(user) 23(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: [<3060E8D0-7020-11D2-842D-00C04FA372D4> <3060E8CE-7020-11D2-842D
-00C04FA372D4>]
Machine extensions: [<35378EAC-683F-11D2-A89A-00C04FBBCFA2> <53D6AB1B-2488-11D1-A
28C-00C04FB94F17>][<827D319E-6EAC-11D2-A4EA-00C04F79F83A> <803E14A0-B4FB-11D0-A0D
0-00A0C90F574B>][
00C04FB94F17>]
Functionality version: 2 DC: nvdc.Nature.Naturesvalue.com
Friendly name: Default Domain Policy
Created: 4/7/2000 5:49:19 PM
Changed: 2/25/2008 7:37:41 PM
DS version: 1(user) 23(machine)
Sysvol version: 1(user) 23(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: [<3060E8D0-7020-11D2-842D-00C04FA372D4> <3060E8CE-7020-11D2-842D
-00C04FA372D4>]
Machine extensions: [<35378EAC-683F-11D2-A89A-00C04FBBCFA2> <53D6AB1B-2488-11D1-A
28C-00C04FB94F17>][<827D319E-6EAC-11D2-A4EA-00C04F79F83A> <803E14A0-B4FB-11D0-A0D
0-00A0C90F574B>][
00C04FB94F17>]
Functionality version: 2 ============================================================
Policy <6AC1786C-016F-11D2-945F-00C04FB984F9>
Friendly name: Default Domain Controllers Policy
Policy OK
Details: DC: exchange.Nature.Naturesvalue.com
Friendly name: Default Domain Controllers Policy
Created: 4/7/2000 5:49:22 PM
Changed: 12/13/2007 8:11:14 PM
DS version: 0(user) 12(machine)
Sysvol version: 0(user) 12(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: not found
Machine extensions: [<827D319E-6EAC-11D2-A4EA-00C04F79F83A> <803E14A0-B4FB-11D0-A
0D0-00A0C90F574B>]
Functionality version: 2 DC: nvdc.Nature.Naturesvalue.com
Friendly name: Default Domain Controllers Policy
Created: 4/7/2000 5:49:22 PM
Changed: 2/9/2008 9:12:26 PM
DS version: 0(user) 12(machine)
Sysvol version: 0(user) 12(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: not found
Machine extensions: [<827D319E-6EAC-11D2-A4EA-00C04F79F83A> <803E14A0-B4FB-11D0-A
0D0-00A0C90F574B>]
Functionality version: 2 ============================================================
Policy <9E447732-A6FA-461A-971F-C293B61D1EE2>
Friendly name: NV Policy
Policy OK
Details: DC: exchange.Nature.Naturesvalue.com
Friendly name: NV Policy
Created: 11/26/2007 4:26:09 PM
Changed: 2/25/2008 5:33:08 PM
DS version: 22(user) 1(machine)
Sysvol version: 22(user) 1(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: [<35378EAC-683F-11D2-A89A-00C04FBBCFA2> <0F6B957E-509E-11D1-A7CC
-0000F87571E3><53D6AB1D-2488-11D1-A28C-00C04FB94F17>][
Machine extensions: [<827D319E-6EAC-11D2-A4EA-00C04F79F83A> <803E14A0-B4FB-11D0-A
0D0-00A0C90F574B>]
Functionality version: 2 DC: nvdc.Nature.Naturesvalue.com
Friendly name: NV Policy
Created: 11/26/2007 4:26:09 PM
Changed: 2/25/2008 5:33:06 PM
DS version: 22(user) 1(machine)
Sysvol version: 22(user) 1(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: [<35378EAC-683F-11D2-A89A-00C04FBBCFA2> <0F6B957E-509E-11D1-A7CC
-0000F87571E3><53D6AB1D-2488-11D1-A28C-00C04FB94F17>][
Machine extensions: [<827D319E-6EAC-11D2-A4EA-00C04F79F83A> <803E14A0-B4FB-11D0-A
0D0-00A0C90F574B>]
Functionality version: 2 ============================================================
Policy
Friendly name: Folder Redirection
Policy OK
Details: DC: exchange.Nature.Naturesvalue.com
Friendly name: Folder Redirection
Created: 6/17/2006 2:49:40 PM
Changed: 7/8/2006 3:23:55 PM
DS version: 2(user) 0(machine)
Sysvol version: 2(user) 0(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: [<25537BA6-77A8-11D2-9B6C-0000F8080861> <88E729D6-BDC1-11D1-BD2A
-00C04FB9603F>]
Machine extensions: not found
Functionality version: 2 DC: nvdc.Nature.Naturesvalue.com
Friendly name: Folder Redirection
Created: 6/17/2006 2:49:40 PM
Changed: 2/9/2008 9:13:32 PM
DS version: 2(user) 0(machine)
Sysvol version: 2(user) 0(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: [<25537BA6-77A8-11D2-9B6C-0000F8080861> <88E729D6-BDC1-11D1-BD2A
-00C04FB9603F>]
Machine extensions: not found
Functionality version: 2 ============================================================
Policy
Friendly name: Response Update
Policy OK
Details: DC: exchange.Nature.Naturesvalue.com
Friendly name: Response Update
Created: 2/24/2008 8:58:59 PM
Changed: 2/25/2008 5:33:08 PM
DS version: 2(user) 3(machine)
Sysvol version: 2(user) 3(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: [<35378EAC-683F-11D2-A89A-00C04FBBCFA2> <0F6B957E-509E-11D1-A7CC
-0000F87571E3>]
Machine extensions:
Functionality version: 2 DC: nvdc.Nature.Naturesvalue.com
Friendly name: Response Update
Created: 2/24/2008 8:58:59 PM
Changed: 2/25/2008 5:33:01 PM
DS version: 2(user) 3(machine)
Sysvol version: 2(user) 3(machine)
Flags: 0 (user side enabled; machine side enabled)
User extensions: [<35378EAC-683F-11D2-A89A-00C04FBBCFA2> <0F6B957E-509E-11D1-A7CC
-0000F87571E3>]
Machine extensions:
Functionality version: 2 ============================================================
C:\Program Files\Windows Resource Kits\Tools>