Category Archives: Active Directory

Group Policiy does not apply on Workstations

Workstation are not applying Group Policies from the Active Directroy. The following are some possible functions on the Workstation:
Running ‘gpupdate’ on Windows XP confirms it runs successfully.
Running ‘gpresult’ on Windows XP gives the error: ‘The user [domainusername] does not have RSOP data.’
You can browse to the netlogon and the sysvol folders on a DC.
Typing the ‘SET’ command shows you have a vaild authentication server.
In order to resolve this make sure the workstation is pointing to a valid internal DNS server which contains Windows Active Directory informaiton. Verify the internal DNS server are functioning properly.
After modifiying the workstations DNS, rerun ‘gpupdate’ and ‘gpresult’. This should now apply the GPO successfully and display the results.
More information can be found here: Technet KB 291382 Frequently asked questions about Windows 2000 DNS and Windows Server 2003 DNS

指定域的名称或安全标识(SID)与该域的信任信息不一致

用vmware来做域的测试。安装一台2003,然后使用vm的clone功能clone出来一台机器。
一台做dc,一台做client。
费劲千辛万苦,dc工作终于正常,而client机器也能加入域了。
结果client使用域用户登录时,提示
 
指定域的名称或安全标识(SID)与该域的信任信息不一致
 
研究了下,发现原来是我clone的原因。
在cmd下运行whoami -all显示sid,这2台机器sid一致,所以出错。
so,
①win2k3按装光盘supporttoolsdeploy.cab中提取sysprep.exe
 ②运行,并在”选择不重置激活的宽限期” 重新封装 并重启,重启后会对SID、网络、电脑名字、公司名字等一些信息重新设置,完。