Home / server / Questions / 654449
Accepted
Sam
Asked: 2014-12-24 09:04:12 +0800 CST

Can't open Active Directory Users and Computers, Group Policy settings issues

  • 772

In the past I've been able to open "Active Directory Users and Computers" to manage the users and computers on our Windows Server 2008 R2 box. We just recently made some changes to our Group Policy to log authentication sucess/failure and enabled the Windows Firewall (I'm assuming the Firewall may be the culprit).

Now when I try to open "Active Directory Users and Computers" I get the following error: enter image description here

When I run dcdiag.exe it passes all of the tests except for System Log. For that one it throws all kinds of errors about Group Policy Settings. For example:

An error event occurred. EventID: 0x00000406 Time Generated:

12/23/2014 09:44:58

Event String: The processing of Group Policy failed. Windows attempted to retrieve new Group Policy settings for this user or computer. Look in the details tab for error code and description. Windows will automatically retry this operation at the next refresh cycle. Computers joined to the domain must have proper name resolution and network connectivity to a domain controller for discovery of new Group Policy objects and settings. An event will be logged when Group Policy is successful.

I'm at a loss and am not sure what to do or to look for next.

EDIT:

I turned off the Firewall in the Group Policy and rebooted the machine. I can now access the Active Directory Users and Computers. So now I'm left wondering which ports/rules I need to enable for a Domain Controller and Active Directory? When I looked at the firewall before it already had a bunch of Active Directory and DNS rules in place with allowed traffic.

windows-server-2008

1 Answers

  1. Best Answer

    I found that the firewall's built-in rules aren't always accurate and sufficient.

    I researched a little this subject once, and found this article.
    This are the ports the article says are generally required:

    UDP Port 88 for Kerberos authentication
UDP and TCP Port 135 for domain controllers-to-domain controller and client to domain controller operations.
TCP Port 139 and UDP 138 for File Replication Service between domain controllers.
UDP Port 389 for LDAP to handle normal queries from client computers to the domain controllers.
TCP and UDP Port 445 for File Replication Service
TCP and UDP Port 464 for Kerberos Password Change
TCP Port 3268 and 3269 for Global Catalog from client to domain controller.
TCP and UDP Port 53 for DNS from client to domain controller and domain controller to domain controller.

    Note that you might need to block some or open others.

    • 2