Group Policy isn't working after Ransomware Attack
-
repadmin /showreplcame back successful for all
repadmin /syncallwas successful for all
repadmin /kccwas successful -
you mean you didn't just kill the old domain and make a new one?
-
Did you ensure the Group Policy client was enabled and started on the workstation you are testing on?
-
Could also be a permissions issue on the folders/locations that are referenced.
-
@coliver said in Group Policy isn't working after Ransomware Attack:
Did you ensure the Group Policy client was enabled and started on the workstation you are testing on?
Yes I did
-
I resolve the above and now I am getting the below error:
The following warnings were encountered during computer policy processing: Windows failed to apply the Scripts settings. Scripts settings might have its own log file. Please click on the "More information" link. Windows failed to apply the Internet Explorer Zonemapping settings. Internet Explorer Zonemapping settings might have its own log file. Please click on the "More information" link. User Policy update has completed successfully. The following warnings were encountered during user policy processing: The Group Policy Client Side Extension Folder Redirection was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance. For more detailed information, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results. Certain user policies are enabled that can only run during logon. OK to log off? (Y/N) -
-
-
@JasGot said in Group Policy isn't working after Ransomware Attack:
@wirestyle22 said in Group Policy isn't working after Ransomware Attack:
How many DCs?
lol.
like 30+
-
Right now I am working on a script to compare all of the files contained within sysvol between all dc's
-
@wirestyle22 said in Group Policy isn't working after Ransomware Attack:
@JasGot said in Group Policy isn't working after Ransomware Attack:
@wirestyle22 said in Group Policy isn't working after Ransomware Attack:
How many DCs?
lol.
like 30+
30 AD Domain controllers?
-
@dafyre said in Group Policy isn't working after Ransomware Attack:
@wirestyle22 said in Group Policy isn't working after Ransomware Attack:
@JasGot said in Group Policy isn't working after Ransomware Attack:
@wirestyle22 said in Group Policy isn't working after Ransomware Attack:
How many DCs?
lol.
like 30+
30 AD Domain controllers?
Over 30
-
@wirestyle22 Problems with all of them? or just the one(s) that was/were hit with Ransomware?
-
@JasGot said in Group Policy isn't working after Ransomware Attack:
@wirestyle22 Problems with all of them? or just the one(s) that was/were hit with Ransomware?
Everything has the same error including workstations when you
gpupdate -
This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?
-
@dafyre said in Group Policy isn't working after Ransomware Attack:
This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?
Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.
-
@wrx7m said in Group Policy isn't working after Ransomware Attack:
@dafyre said in Group Policy isn't working after Ransomware Attack:
This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?
Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.
Nuke and pave is always a good answer... but jeez... Why do you need so many DCs to start with?
Our AD infrastructure here has nearly 40k people in it and we only have 6.
-
@wrx7m said in Group Policy isn't working after Ransomware Attack:
@dafyre said in Group Policy isn't working after Ransomware Attack:
This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?
Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.
huh - who asked about that earlier?
-
@dafyre said in Group Policy isn't working after Ransomware Attack:
@wrx7m said in Group Policy isn't working after Ransomware Attack:
@dafyre said in Group Policy isn't working after Ransomware Attack:
This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?
Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.
Nuke and pave is always a good answer... but jeez... Why do you need so many DCs to start with?
Our AD infrastructure here has nearly 40k people in it and we only have 6.
We ask that question every day
-
We didn't restore the DC's fully, just sysvol. Once we stopped the spread we spun up a new DC and took FSMO roles. Then on the weekend we built all new domain controllers.
