-1

This is kinda weird. I have the Group Policy Management console installed on my Windows 7 workstation and I configure policies from there. Sometimes I do it directly on a domain controller, but most of the time I work with my management console. The thing is, networking team detected that many random client computers are establishing connections to my computer at port 445 and also detected something running from y PC trying to change registry values on the client. I recently created a GPO with a login script that copy some jpgs to a local folder on each client and change the screensaver.
Is it even possible that somehow the GPO is pointing the script at my computer? I triple checked the GPO configuration and the login script is located at the GPO folder on SYSVOL. Any way to check that? DC is Windows Server 2008 R2.

Thanks a lot.

Black Lion
  • 79
  • 1
  • 5

1 Answers1

1

Check DNS. For now it looks like it is messed up.

The as-domain ("@") A resource record should always point to nearest domain controllers, and should not point anywhere else. I.e. in AD domain "example.com" should be a DNS record "example.com. A dc.ad.dre.ss" for each domain controller, and shouldn't be any other "example.com." A entries.

These records should be added automatically when you add a domain controller.

This is the way redundancy and distributed filesystem for SYSVOL is implemented. Clients connect to domain's sysvol via "\\example.com\SYSVOL", i.e. use domain FQDN to access it, and if everything is configured properly they'll end up talking with some domain controller.

Windows keep sysvol files on different domain controllers in sync, so you could update GPOs on any controller, and they'll end up distributed to other DCs automatically. However, this is not done in realtime, and this is one of reasons why GPOs could not work immediately after update.

I want to mention some Samba4 AD controller behaviour here. Samba4 has no integrated provision of syncing files in SYSVOL, and you have to do this externally (usually this is done via rsync, maybe lsycnd). There are also problems synching from Samba4 DC to Windows DC. For example, Zentyal DC (which is based on Samba4 and Debian) only supports syncing of SYSVOL from Windows to Zentyal or from Zentyal to Zentyal.

In any case, if you own a registered domain name "example.com", do not create Active Directory with the same name, else you will not be able to use naked "example.com" name for, say, web site. This is known MS AD drawback. Microsoft also doesn't recommend this; they recommend to create some subdomain and start AD tree from there.

Nikita Kipriyanov
  • 8,033
  • 1
  • 21
  • 39