Group Policy isn't working after Ransomware Attack

wirestyle22

We've rebuilt all of our domain controllers after we got hit with ransomware. A pretty big metadata cleanup needs to occur.

I ran gpupdate /force to see what errors it threw out

The processing of Group Policy failed. Windows attempted to read the file \\Domain.local\SysVol\Domain.local\Policies\{unique identifier}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following:
a) Name Resolution/Network Connectivity to the current domain controller.
b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller).
c) The Distributed File System (DFS) client has been disabled.
User Policy could not be updated successfully. The following errors were encountered:

There are some shares in sysvol that don't exist anymore upon our restore. Would that cause the entirety of group policy to shutdown or just the application of said GPO's that are being referenced?

wirestyle22

repadmin /showrepl came back successful for all
repadmin /syncall was successful for all
repadmin /kcc was successful

Dashrender

you mean you didn't just kill the old domain and make a new one?

coliver

Did you ensure the Group Policy client was enabled and started on the workstation you are testing on?

coliver

Could also be a permissions issue on the folders/locations that are referenced.

wirestyle22

@coliver said in Group Policy isn't working after Ransomware Attack:

Did you ensure the Group Policy client was enabled and started on the workstation you are testing on?

Yes I did

wirestyle22

I resolve the above and now I am getting the below error:

The following warnings were encountered during computer policy processing:

Windows failed to apply the Scripts settings. Scripts settings might have its own log file. Please click on the "More information" link.
Windows failed to apply the Internet Explorer Zonemapping settings. Internet Explorer Zonemapping settings might have its own log file. Please click on the "More information" link.
User Policy update has completed successfully.

The following warnings were encountered during user policy processing:

The Group Policy Client Side Extension Folder Redirection was unable to apply one or more settings because the changes must be processed before system startup or user logon. The system will wait for Group Policy processing to finish completely before the next startup or logon for this user, and this may result in slow startup and boot performance.

For more detailed information, review the event log or run GPRESULT /H GPReport.html from the command line to access information about Group Policy results.

Certain user policies are enabled that can only run during logon.

OK to log off? (Y/N)

wirestyle22

JasGot

@wirestyle22 said in Group Policy isn't working after Ransomware Attack:

How many DCs?

wirestyle22

@JasGot said in Group Policy isn't working after Ransomware Attack:

@wirestyle22 said in Group Policy isn't working after Ransomware Attack:

How many DCs?

lol.

like 30+

wirestyle22

Right now I am working on a script to compare all of the files contained within sysvol between all dc's

dafyre

@wirestyle22 said in Group Policy isn't working after Ransomware Attack:

@JasGot said in Group Policy isn't working after Ransomware Attack:

@wirestyle22 said in Group Policy isn't working after Ransomware Attack:

How many DCs?

lol.

like 30+

30 AD Domain controllers?

wirestyle22

@dafyre said in Group Policy isn't working after Ransomware Attack:

@wirestyle22 said in Group Policy isn't working after Ransomware Attack:

@JasGot said in Group Policy isn't working after Ransomware Attack:

@wirestyle22 said in Group Policy isn't working after Ransomware Attack:

How many DCs?

lol.

like 30+

30 AD Domain controllers?

Over 30

JasGot

@wirestyle22 Problems with all of them? or just the one(s) that was/were hit with Ransomware?

wirestyle22

@JasGot said in Group Policy isn't working after Ransomware Attack:

@wirestyle22 Problems with all of them? or just the one(s) that was/were hit with Ransomware?

Everything has the same error including workstations when you gpupdate

dafyre

This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?

wrx7m

@dafyre said in Group Policy isn't working after Ransomware Attack:

This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?

Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.

dafyre

@wrx7m said in Group Policy isn't working after Ransomware Attack:

@dafyre said in Group Policy isn't working after Ransomware Attack:

This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?

Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.

Nuke and pave is always a good answer... but jeez... Why do you need so many DCs to start with?

Our AD infrastructure here has nearly 40k people in it and we only have 6.

Dashrender

@wrx7m said in Group Policy isn't working after Ransomware Attack:

@dafyre said in Group Policy isn't working after Ransomware Attack:

This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?

Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.

huh - who asked about that earlier?

wirestyle22

@dafyre said in Group Policy isn't working after Ransomware Attack:

@wrx7m said in Group Policy isn't working after Ransomware Attack:

@dafyre said in Group Policy isn't working after Ransomware Attack:

This sounds like the AD Servers were restored from a backup and got out of sync... Could that be the case?

Yeah, it does. I am pretty sure that if you have an issue that you need to restore AD, you would bring down all DCs and restore a single DC, then add new DCs. But, I am thinking this would be better to do a completely new AD environment. Too many ghosts.

Nuke and pave is always a good answer... but jeez... Why do you need so many DCs to start with?

Our AD infrastructure here has nearly 40k people in it and we only have 6.

We ask that question every day