https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# _general
s
This message was deleted.
s
Login script in User object or GPO? If GPO, is it only a specific GPO? Are they pathed to a specific server instead of using the domain name as the server in the UNC? Just a couple of things that came to mind
d
Yes, these are in the User object of GPOs. Not a specific GPO that I can tell so far. We will be doing more testing Monday and gathering more information though. There is no pathing in the scripts that I know are causing issues. They just launch SetUserFTA.exe with a text file configuration parameter. Appreciate the ideas.
This isn't limited to only the login scripts. It also isn't limited to the remote servers. All servers are pulling all Group Policies from the PDC emulator by default. This feels like a setting somewhere that I haven't been able to locate yet. If I block access to the PDC Emulator from the remote system, it picks a local DC to pull GPO from.
After much more research, this is somehow related to how the connection is being made for SMB to the \\domainname\Sysvol share. DNS is properly configured for netmask ordering and is working. 
nltest /dsgetdc:domainname
returns a local domain controller. 
net use \\domainname
picks a local domain controller. 
net use \\domainname\sysvol
connects to PDC Emulator, but could just be using the existing connection to this location. Not all servers are performing this way. After a restart some, but not all servers are properly connecting to a local domain controller. I am trying to find something that describes the lookup process for Sysvol connections, but nothing is jumping out as useful. If I could reset the connection or cached entry, that would probably fix the issue as well.
s
Check how the AD Sites are configured and if they are replication properly
d
Yup, did that. Sites are configured properly. Don't see any issues with replications. No recent entries in the systems not assigned to sites (can't remember the name of the log off the top of my head, but I ran a script that checked all of the domain controllers)
s
the servers that are NOT contacting local DCs, are they in the proper sites?
d
Yes, everything is in proper sites.
s
sorry, you've tapped my knowledge! Good luck!
d
Appreciate the help.
After some more in-depth looking through ProcMon, I think I may have discovered the root cause. We deployed a security tool recently that appears to be making calls to the PDC emulator that are then being "piggy-backed" on for additional SMB calls, like GPT.INI and login scripts. This is not 100% proven yet, but the time frame for things fit and the evidence leads me to believe this is the case. I have a ticket open with the vendor for assistance. Would not expect anyone to have been able to fix this, since it isn't standard features not working. Thanks again for trying though.
s
Nice catch. Hope its the cause and can be reveresed.
4 Views
Open in Slack
PreviousNext
Powered by