Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9}

Event ID:1030

Windows cannot query for the list of Group Policy objects. Check the event log for possible messages previously logged by the policy engine that describes the reason for this.

Event ID: 1058


Windows cannot access the file gpt.ini for GPO CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=,DC=. The file must be present at the location <\\DOMAIN.EXT\sysvol\DOMAIN.EXT\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini>. (Access is denied. ). Group Policy processing aborted.


These event log are driving me crazy for last 2hrs, finally I got the solution.

First of all what is this CN={31B2F340-016D-11D2-945F-00C04FB984F9}?
{31B2F340-016D-11D2-945F-00C04FB984F9} is default domain policy
(http://support.microsoft.com/kb/216359)

Solution

Try accessing the following location while logged on to the server which is
having the problem Vs the server which is not seeing the problem.

\\DOMAIN.EXT\sysvol\DOMAIN.EXT\Policies\ {31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini

On the server which is seeing the errors and we are not able to access the
following share, please ping the domain and see which domain controller is
responding and see if we are able to access that DC doing a \\dcname

If accessing
\\DOMAIN.EXT\sysvol\DOMAIN.EXT\Policies\ {31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini
fails, please try accessing the same file going to the \\DOMAIN.EXT
and then locating the file.


Also check SYSVOL permission settings as described in MS KB 290647 (http://support.microsoft.com/kb/290647)

If all of these are successful and we are still seeing the error message.
Then, there should be a problem with the DFS cache as it didn't get pruged on
the client.

to purge the cache, please use the resource kit utility DFSUTIL

Go to command prompt and run these commands

C:\>dfsutil /purgemupcache
C:\>gpupdate /force

Now check event viewer , You should have event log 1704

Security policy in the Group policy objects has been applied successfully.

Migrate from SBS 2003 to 2003 Standard (Without Transition Pack)

Migrating from SBS 2003 SP1 to 2003 Standard R2

If you don't want to buy Transition Pack, you can setup a new Windows 2003 server in the SBS domain and set it as additional DC. And then use FSMO role transfer method to transfer all the roles from SBS 2k3 server to Windows 2003. Migrate all AD information, user profile, database and service such as DNS and DHCP you need from the server.

For the share folder information, you could just use copy command. For the Exchange information, you could use Exchange Migration wizard or use Exmerge utility. For the client workstation, you need to update the Exchange server location.

You can refer to the following KB article to do it:

328871, "How to: Use the Exchange Migration Wizard to Migrate Mailboxes from an Exchange Organization" at the Microsoft Web site http://support.microsoft.com/?id=328871

To move SQL server database: you can follow the instructions in the article:

How to: Move Databases Between Computers That Are Running SQL Server http://support.microsoft.com/?id=20167

If you want to move other information, I suggest that you view the Microsoft white paper to get info: Migrating from Small Business Server 2000 or Windows 2000 Server to Windows Small Business Server 2003 http://www.microsoft.com/downloads/details.aspx?familyid=FA187D1E-821...9729-222BD8EBB64C&displaylang=en

I would like to list the detail steps to upgrade SBS 2003 to Windows 2003 server:

0. Start the installation of Windows 2003 on a new hardware. Once the operating system is installed, the server will reboot.

a. On the Windows 2003, configure a static IP on the LAN network card and make sure to point DNS to the old SBS server hosting active directory zone.

b. Run DCPROMO on the new Windows 2003 server to join it into the existing domain, do not create a new forest, and do not create a child domain. Install DNS, do not change any DNS settings yet.

1. Set the New Server as GC (Global Catalog Server). To set a DC as a GC, you can follow the steps in the following MS Knowledge Base article:

816105 HOW TO: Create or Move a Global Catalog in Windows Server 2003 http://support.microsoft.com/?id=816105

2. Remove Exchange attributes (not mailbox) from all users by choose the Exchange Task in "Active Directory Users and Computers". If you find that you only have the three items (Delete Mailbox, Move Mailbox and Enable Instant messages.), you can just ignore them. This step is only to make sure to remove all other attributes you have configured for users.

3. Stop DHCP on SBS 2003, install DNS (make it AD Integrated so that it will replicate all DNS information from the SBS server) and DHCP on the new Windows Server 2003 server and then configure the DHCP scope the same as SBS 2003.

4. Configure the new server to point to itself for DNS. Configure all the client computers to point to the new server as DNS. If you are using DHCP to issue DNS server settings, you should configure your new DHCP server to reflect the changes.

5. After making sure the clients can successfully log on, open Active Directory Users and Computers, connect to the new server and remove the SBS 2003 server account from the Domain Controllers container.

6. Take the old SBS server offline.

Then you can format the old server and install Windows server 2003 server. After you installed OS and join the box to domain, you can install exchange server 2003 in the box and import the mailboxes from the PST files (if you have export the mailboxes

Jenny Wu
Microsoft CSS Online Newsgroup Support

Taken From:http://groups.google.co.in/group/microsoft.public.windows.server.sbs/

Creating a trust relationship between two Small Business Server 2000 domains

Taken from: http://fac.ce.vreau.eu.org/sbs.html

* A backup solution (in case you mess up with something)

* Two windows 2000 or windows 2003 servers (I have played with the trial version of windows 2003 server, but I think 2000 srv would do the job just fine)

* The 'replmon.exe' utility

* Patience (a lot ! especially if you have a slow link between the two sbs's)

Okay, let's begin (Make sure you follow the steps below for each domain ;) ) :

* Configure your SBS DNS server to allow dynamic updates (you will need this in order to add an additional dc) - I have even switched from ad-integrated mode to standard primary to avoid ad replication issues. Make sure each dns server contains a slave zone for it's partner dns zone, so one SBS can locate the other SBS

* Add each SBS WINS server as a replicating partner (so pre-windows 2000 clients will be able to locate the other domain)

* If you intend to play with w2k3, upgrade your sbs ad schema (run adprep /forestprep followed by adprep /domainprep from the i386 folder on your w2k3 cd or mapped network drive). Make sure you meet requirements for running adprep (you need to have your sbs at sp2 level or more, or have the needed patches - see http://www.petri.co.il/win2003_adprep.htm or better http://support.microsoft.com/?scid=331161). I was in sp3 and it worked fine

* Install the additional server (do not install a dns server, it will make things go slower because you will need to wait for dns replication)

* Make sure your new server is using only sbs dns as it's dns server

* Go through dcpromo

At this point you should have two domain controllers in your sbs forest

Now comes the interesting part.

As you all know, the sbs is a global catalog, and it is handling all 5 fsmo roles.

The trick is to move all the roles to your brand new additional dc, do the same within the other domain, establish the trust relationship, transfer the roles back to sbs's and demote the temporary servers.

Using ntdsutil, move all 5 fmso roles ( i know it might be only one that matters, but do not know yet wich one - I think the pdc emulator ?)

* at ntdsutil prompt, type:

roles
connections
connect to server NEW_DC (where NEW_DC is the name of the new temporary dc)
quit
transfer rid master
transfer pdc
transfer domain naming master
transfer infrastructure master
transfer schema master
quit
quit

I have also made new dc a global catalog, just to make sure I do not depend on sbs2k at all ;)
Of course there are other ways to transfer the fmso roles, but I like it this way, I come from linux world and I like typing :P

Now comes the patience part

* You have two choices. Either wait for the normally replication, or manualy initiate it. To check how each server knows about server roles, I have used the fsmo.vbs script (found at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/scriptcenter/compmgmt/ScrCM24.asp). For manual replication I have used the 'replmon' utility found under \support\tools folder on the install cd and Active Directory Sites and Services mmc snap-in.

Basically, reading http://gracie.santarosa.edu/~mckeever/Active%20Directory/Reading/6%20Essential%20Tools%20for%20Troubleshooting%20AD%20Replication.htm should help you get through it.

http://www.winnetmag.com/articles/index.cfm?ArticleID=7429&pg=2 and http://www.netpro.com/forum/messageview.cfm?catid=7&threadid=42 might also be very helpful sources of information

* After you make sure that the fsmo roles have transferred to the new dc... go and create your trust as you normally would (note: do this operation on the new dc... not on sbs server!)
(For the really paranoid only: disconnect the sbs dc's from network before establishing the trust)

* Transfer back the roles to sbs

* Demote your new dc

* At this point all your MVP friends will still tell you "no, it's not possible, are you speaking about PTA ?" and eventually a Microsoft PSS will repeat saying that "Trust relatioinship is not supported in any SBS suites (SBS 4.0/4/5/2000/2003)"

But you don't care. You've just created a trust between two Small Business 2000 Servers, and yes, you see it working.

How to prepare the SBS domain for an additional R2 Domain Controller

Taken from: http://www.smallbizserver.net/tabid/266/articleType/ArticleView/articleId/221/Default.aspx

There are several reasons for needing an additional Domain Controller. As it will hold a replica of the Active Directory, the Group Policies and login scripts etcetera, it can be used to serve a remote location like a branch office. The additional DC is also used in the Swing It migration from Jeff Middleton to migrate a domain while upgrading to a newer SBS version or new hardware. It doesn't matter if you are still running SBS 2000 or SBS 2003 with or without R2, you will need to prepare the AD Forest as described in this article.

You can NOT use the SBS media for installing an additional server or Domain Controller, you will need to purchase a plain Windows 2003 server license and media. As you can only get R2, you will be looking at upgrading the Active Directory Schema, as it is different from Windows 2003 server RTM.

You will need the second R2 CD from the plain Windows 2003 R2 server media kit and use that on the SBS server. You need to login as the administrator on the server.

1. Open the command prompt on the SBS server and navigate to the CD drive. Then navigate to the Adprep folder with: cd CMPNENTS\R2\Adprep



2. Type the following command to prepare the Active Directory Forest: adprep /forestprep



3. Assuming there are no Windows 2000 domain controllers that are not up to date with SP4, type C and press Enter:



4. Depending on the SBS version, it can take 5 to 10 minutes before the command has successfully finished:



5. The Active Directory is now prepared for additional R2 domain controllers, and the Directory Service event log will show a bunch of 1137 events that were logged during the adprep operation:

If you already have other domain controllers in the network, you will need to update those with:

• adprep /domainprep

This command will be finished a lot quicker. You are now ready to add additional Domain Controllers that will be running Windows 2003 R2.

Migrate from sbs 2000 to a regular domain 2003

Yes - Yes you can migrate from sbs 2000 to a regular domain 2003 (without any transition pack)




Trust me it is possible and we have recently done it. The procedure is very simple. Read this article How to prepare the SBS domain for an additional R2 Domain Controller first and add addition R2 Domain Controller to your domain. This article
Creating a trust relationship between two Small Business Server 2000 domains will also help you lot.

After adding addition domain controller to your domain wait for full replication (It is nice to wait for at least 24hr, now shut your SBS domain controller down and size all roles from it. This article will help you in this process "How can I forcibly transfer(seize) some or all of the FSMO Roles from one DC to another?"