Sunday, November 24, 2019

GPUpdate failing due to LDAP Bind Issue

For some reason one computer in my domain cannot update domain policy. Wen I try to force update policy it gives me error:

Computer policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following:
a) Name Resolution failure on the current domain controller.
b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
User Policy could not be updated successfully. The following errors were encountered:

The processing of Group Policy failed. Windows could not authenticate to the Active Directory service on a domain controller. (LDAP Bind function call failed). Look in the details tab for error code and description.

To diagnose the failure, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.
Running gpresult /h gives The user does not have RSoP data
Log event viewer shows that that gpupdate fails with an error code 49 Invalid Credentials.

Fix I've found somewhere on serverfault.com

1. Download PsExec from https://docs.microsoft.com/en-us/sysinternals/downloads/psexec
2. From an elevated command prompt run PsExec.exe -i -s cmd.exe
3. From that window, run rundll32.exe keymgr.dll, KRShowKeyMgr (That will open a gui with a list of cached credentials).
4. In that gui, delete any credentials that look suspicious (In my case the credentials were named after my PDC).