Fix Group Policy folder redirection causing RemoteApp failures and profile issues

draft · os-and-system group-policyfolder-redirectionremoteappdomain-controllerreplication

Generated by docuprocessor (prompt article/v3) · 2026-04-22 08:34

Source thread

thread_id: spaces/AAAA05BdS6s/threads/iQGj2QFKpHQ · 278 msgs · first 2024-07-07 · participants: Tech ATech BTech CTech DTech ETech F

Tech A 2024-07-07 13:28

Ok, leave it then. Help Vlad with teaneck

Tech B 2024-07-07 13:28

I'm starting from the top

Tech C 2024-07-07 13:33

ok ill do from the end

Tech B 2024-07-07 13:39

So Desktop,documents,pics automatically pointing to \\172.17.130.20\redir$\tea-fd01\Desktop but its not showing any of the files from \\tea-svr\docs$ - anything specific I should do for this issue ?

Tech A 2024-07-07 13:40

Only HQ ppl are pointed to the NAS.

Tech A 2024-07-07 13:41

Move the docs, pics and desktop to the local server

Tech B 2024-07-07 13:42

It's already on the local server - do you mean copy it to the redir$ path as well?

image/png image.png

The image shows a Windows File Explorer window open to a network path: `\\tea-svr\docs$\TEA-FD01\Desktop`. The directory contains 44 items, including multiple file folders named with provider names and date ranges (e.g., "DR. MASER 06-28," "DR. JEONG 06-05"), along with Microsoft Excel workbooks (notably "751 PDS\_InventoryWorkbook\_Master-LO..." at 485 KB), a Word document ("cover sheet"), a PDF ("DESIGNEE FORM"), and several application shortcuts (Dentrix, Dolphin Imaging, EPSON Scan, Excel). No error messages, diagnostic codes, or hardware indicators are visible.

Tech A 2024-07-07 13:42

No.

Tech A 2024-07-07 13:42

Forget about the nas

Tech A 2024-07-07 13:43

If its pointed to the nas, change it to the local server.

Tech B 2024-07-07 13:43

it's not letting me change it.. o.O

Tech A 2024-07-07 13:43

Via registry?

Tech B 2024-07-07 13:44

trying 1 sec

Tech C 2024-07-07 13:46

whats the dns ip for svr

Tech B 2024-07-07 13:46

172.17.182.10

Tech B 2024-07-07 13:52

BTW - TEA-FD02 is having that issue where its taking forever to login to local account - skipping this one for now

Tech C 2024-07-07 13:53

change color quality

Tech B 2024-07-07 13:55

btw - repointing by registry and rebooting afterwards worked

Tech D 2024-07-07 13:55

Are all sites redirected? It should be only corporate

Tech C 2024-07-07 13:56

i saw it in wyckoff and now teaneck

Tech B 2024-07-07 13:56

teaneck is the second office I worked on, only noticed it with this one so far

Tech A 2024-07-07 13:56

No, just HQ. Not sure why it was redirected

Tech D 2024-07-07 13:56

Ok hol up let me check gpo

Tech C 2024-07-07 14:02

so tea-svr\docs$ are there we just need to repoint them back

Tech C 2024-07-07 14:04

oh lol registry only

Tech D 2024-07-07 14:04

i adjusted gpo, it should not be redirecting sites other than corporate specific users group

Tech C 2024-07-07 14:06

question is if if need to go back to all of the sites now and check them again

Tech C 2024-07-07 14:07

@Vladimir Sobko where in registry u changed it?

Tech D 2024-07-07 14:07

im gpupdayting every server, the gpo should only apply on logon, if it did not apply before it should not apply now

Tech B 2024-07-07 14:07

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell

Tech C 2024-07-07 14:09

so we still need to configure registry for every pc now?

Tech B 2024-07-07 14:11

Alex adjusted GPO - that should help since he limited it to corporate specific users

Tech B 2024-07-07 14:11

(I think o.o )

Tech D 2024-07-07 14:19

you can check if policy is applied to the computer by running gpresult /r

Tech B 2024-07-07 14:21

So in this case should I still be pointing via registry?

image/png image.png

**CMD window displaying `gpresult /r` output for user TEA-FD02 on domain PDSMGMT.** OS Version is **10.0.19045** (Windows 10), machine is a **Member Workstation** connected to domain controller **TEA-SVR.pdsmgmt.local**. Applied GPOs listed include: *RemoteApps Distribution, Dentrix Shortcut, Map Drives Teaneck, Dolphin Shortcut, EnableRemoteShortcutIcons, Corporate Folder Redirection, Pearl Shortcuts,* and *Map Dentrix Reports*; a filtered GPO section is visible but cut off at the bottom.

Tech D 2024-07-07 14:22

try gpupdate and see if it gets removed

Tech B 2024-07-07 14:23

Did not get removed after running gpupdate

Tech D 2024-07-07 14:25

hmm.. local server hasnt replicated updated gpo yet

Tech C 2024-07-07 14:27

yup mine too

Tech D 2024-07-07 14:28

teaneck just updated, gpupdate /force youll see a message

Tech D 2024-07-07 14:33

wyck, malone, valley stream

Tech B 2024-07-07 14:34

asked me to log out and log back in :

image/png image.png

**Windows PowerShell (Administrator) — `gpupdate /force` Output** Both Computer Policy and User Policy updates completed successfully; however, a warning was generated stating the **Group Policy Client Side Extension Folder Redirection** was unable to apply one or more settings because changes must be processed before system startup or user logon. The terminal also displays the message: *"Certain user policies are enabled that can only run during logon"* and prompts **"OK to log off? (Y/N)"**. No error codes are displayed; the recommended diagnostic command referenced on-screen is `GPRESULT /H GPReport.html`.

Tech B 2024-07-07 14:34

didn't help though o.O should I reboot and check after?

Tech B 2024-07-07 14:36

rebooting to see if it helps , doing others in the meantime

Tech D 2024-07-07 14:37

the message kinda explains it

Tech A 2024-07-07 14:41

@Alex Kaplun HQ is ready to be demoted

Tech B 2024-07-07 14:43

So same thing after reboot for me o.O Anything else I should try?

Tech D 2024-07-07 14:44

same thing as in the policy still there? gpresult /r

Tech B 2024-07-07 14:44

yeah

Tech D 2024-07-07 14:52

original policy has the 'leave contents' on removal changing to 'restore contents' probably won't have effect after the fact

Tech C 2024-07-07 14:52

so manually to redo registry?

Tech C 2024-07-07 14:52

the problem is it picked up even on pcs we werent suppose to redirect like ops

Tech B 2024-07-07 14:55

yea are we repointing via registry then? or waiting for now o.o

Tech D 2024-07-07 14:56

who's on teaneck

Tech B 2024-07-07 14:56

me and boris doing teaneck

Tech D 2024-07-07 14:57

try gpupdate /force and then reboot one more time if it doesn't redirect back then registry it is

Tech B 2024-07-07 14:57

got it, okay

Tech B 2024-07-07 15:01

yeah didn't help D: doing via registry

Tech B 2024-07-07 15:34

For TEA-OP01 im not seeing Dentrix as published, only seeing 3 programs o.O

image/png image.png

**Remote desktop session (LogMeIn) on workstation TEA-OP01 at PDS Teaneck – 751.** The **RemoteApp and Desktop Connections** Control Panel window shows a "Work Resources" connection with status **Connected**, containing **3 programs and 0 desktops**; most recent update was **Sunday, July 07, 2024 at 11:33 AM** with message **"Update successful"**, and date created **Sunday, July 07, 2024 at 11:32 AM**. The accompanying File Explorer window confirms three shortcuts installed under the Work Resources (RADC) Start Menu folder: **Dolphin (Work Resources)**, **MyAlignTech (Work Resources)**, and **OrmcoDTX (Work Resources)**, all dated **7/7/2024 11:33 AM**.

Tech D 2024-07-07 15:35

can you reach \\img01

Tech B 2024-07-07 15:35

yea

Tech D 2024-07-07 15:36

check even log for gpo errors warnings

Tech B 2024-07-07 15:38

hmm well gpupdate is failing

image/png image.png

**CMD Window:** `gpupdate /force` was executed on host `TEA-OP01.PDSMGMT`; Computer Policy updated successfully, but User Policy failed with an error referencing inability to read `\\pdsmgmt.local\SysVol\pdsmgmt.local\Policies\{6F0E2F9A-85B4-4F43-920F-D333230277BB}\gpt.ini` from a domain controller. **Event Viewer:** System log shows **Event ID 1058**, Source: `GroupPolicy (Microsoft-Windows-GroupPolicy)`, Level: **Error**, logged **7/7/2024 at 11:35:10 AM**, User: `PDSMGMT\TEA-OP01`, Computer: `TEA-OP01.pdsm`, Task Category: None, OpCode: (1); error message mirrors the GPO file read failure noted in the CMD output.

Tech D 2024-07-07 15:41

whats your dns

Tech B 2024-07-07 15:41

172.17.182.10 primary, 172.17.200.11 is secondary

Tech C 2024-07-07 15:41

same error for me

Tech C 2024-07-07 15:42

and i have no remote apps at all

Tech E 2024-07-07 15:46

same here for 2 offices

Tech A 2024-07-07 15:50

also, the certificate issue with the HQ TS

image/png image.png

A Remote Desktop Connection attempt is being made to **HQ-TSVR.pdsmgmt.local** under user **pdsmgmt\vsalazar**, but the security certificate warning dialog shows the certificate name returned by the remote computer is **HQ-SVR.hqrcms.local** — a mismatch from the target hostname. Two certificate errors are displayed: **"A revocation check could not be performed for the certificate"** and **"The certificate or associated chain is invalid (Code: 0x10000)"**.

Tech D 2024-07-07 15:53

is that remote user? did you delete old certificate?

Tech A 2024-07-07 15:54

of course not!

Tech E 2024-07-07 15:56

i figured out a way to get the remote apps to show. so when we redirect folder was pushed via gpo, it put the shortcuts to remote apps there and then when we changed it via registry instead of the explorer method, it diidnt ask us to copy the contents of previous desktop so we have to first copy it ourselves from redirect to the local server profile folder and then change registries.

Tech A 2024-07-07 15:56

i dont have it installed

Tech A 2024-07-07 15:56

@Alex Kaplun

Tech C 2024-07-07 15:58

why u have to do all that ,local folders werent deleted

Tech C 2024-07-07 15:59

i just logged into op9 and all folders pointed localy

Tech C 2024-07-07 16:06

guys,so what do we do

Tech D 2024-07-07 16:08

connect to tsvr2 instead

Tech C 2024-07-07 16:09

@Vladimir Sobko did u have pcs with outlook?

Tech B 2024-07-07 16:09

no not yet

Tech D 2024-07-07 16:22

HQ SERVER is done 172.17.130.30

Tech D 2024-07-07 16:23

@Sergey Starodub does (172.17.130.11) hq-tsvr2.pdsmgmt.local work?

Tech A 2024-07-07 16:24

it does but throwing the *.pdsmgmt.local every time despite me installing it.

Tech D 2024-07-07 16:25

did you put it in both Trusted Root Certification Authority and Personal ? the cert contains both

Tech A 2024-07-07 16:27

Correct

Tech A 2024-07-07 16:46

@Alex Kaplun redirect is not working for HQ users. At least one

image/png image.png

**Group Policy Results (gpresult) output for user Brian McIliverty** (CN=Brian McIliverty, OU=Corporate, DC=pdsmgmt, DC=local). Group Policy was last applied **7/7/2024 at 12:39:02 PM** from server **HQ-SVR1.pdsmgmt.local**, with a slow link threshold of **500 kbps**, on domain **PDSMGMT** (Windows 2008 or later). Applied GPOs include: RemoteApps Distribution, Dentrix Shortcut, Dolphin Shortcut, EnableRemoteShortcutIcons, Pearl Shortcuts, and Map Dentrix Reports; Local Group Policy was filtered out as **Not Applied (Empty)**; user is a member of **Domain Users** and **Everyone**.

Tech A 2024-07-07 16:47

username BMcliverty

Tech D 2024-07-07 16:49

�

Tech D 2024-07-07 16:50

upgrading plattsburgh wg firmware, it will reboot

Tech D 2024-07-07 16:53

never mind its expired

Tech C 2024-07-07 16:58

any updates on apps

Tech D 2024-07-07 17:01

where at?

Tech B 2024-07-07 17:01

teaneck

Tech D 2024-07-07 17:03

splashmein

Tech B 2024-07-07 17:04

906 085 291

Tech B 2024-07-07 17:04

having same issue on all pc's now it seems

Tech D 2024-07-07 17:08

This started after registry change? Can you show me what you modify

Tech B 2024-07-07 17:09

had no issues first few pc's but yes 1 sec

Tech C 2024-07-07 17:09

no i dont get with any of the pcs without registry change

Tech A 2024-07-07 17:10

what registry are you referring to?

Tech C 2024-07-07 17:10

also who was backing up teaneck i dont have any outlook info or chrome passwords and boomarks

Tech A 2024-07-07 17:10

Boris, dont worry about Outlook, we dont have time for that, will have to address later

Tech B 2024-07-07 17:11

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell to point desktops. Alex that PC you are on is an operatory , no registry change was made there

Tech B 2024-07-07 17:11

@Boris Dobronevsky the fd pc's had chrome passwords/bookmarks not sure of others

Tech C 2024-07-07 17:11

i am on manager all empty

Tech C 2024-07-07 17:11

but ok

Tech A 2024-07-07 17:16

for me the registry change didnot even get applied.

Tech B 2024-07-07 17:16

need to reboot for it to go in effect

Tech A 2024-07-07 17:16

i did

Tech C 2024-07-07 17:51

anything?

Tech D 2024-07-07 17:54

This redirection policy screwing things, profiles that shouldn’t have applied it, now can’t reverse, and causing other policies to fail

Tech C 2024-07-07 17:56

so we are able to point all wks to locally stored profiles on the local servers

Tech C 2024-07-07 17:57

how manually can we add the remote apps

Tech A 2024-07-07 18:14

@Alex Kaplun should we then disable redirection for now and move folders locally until we figure out the issue?

Tech C 2024-07-07 18:15

all teaneck done folders were pointed manually to local svr

Tech C 2024-07-07 18:15

waiting for apps

Tech D 2024-07-07 18:16

i just deleted that whole policy, its sill getting called by some clients

Tech B 2024-07-07 18:29

Guys I have to head out - teaneck is good to go just remote apps left to go (its connected on 751 fd1 , fd02, fd06 though)

Tech D 2024-07-07 18:40

policy deleted but waiting for propagation

image/png image.png

**Group Policy Management Console — pdsmgmt.local Domain Replication Status** The Status tab shows **9 domain controllers with replication in progress** (indicated by a red question mark warning indicator), and **6 domain controllers with replication in sync** (green checkmark). The listed domain controllers are: BXORTHO-SVR1, CATS-SVR, HQ-SVR1, KING-SVR1, MONS-SVR, PLATT-SVR, QUEENS-SVR, TEA-SVR, and VS-SVR1 — all under the pdsmgmt.local domain — with Active Directory showing **"Number of GPOs"** links and SysVol columns unpopulated, and the status bar reads **"Generating report..."** with DC01.pdsmgmt.local identified as the baseline domain controller.

Tech C 2024-07-07 18:50

so we just need to restart it and thats it?

Tech D 2024-07-07 18:56

Once the servers finish replicating and they all agree that redirect policy is gone, the rest of policies should be working

Tech E 2024-07-07 18:56

ok working for me on the PCs I just tried

Tech C 2024-07-07 19:02

teaneck still nothing

Tech D 2024-07-07 19:03

yeah im on teaneck still replicatin

Tech C 2024-07-07 19:27

still?

Tech D 2024-07-07 19:28

its still going down to 6 from 9

image/png image.png

Tech C 2024-07-07 19:28

so we wait

Tech C 2024-07-07 19:33

Sergey did u look into Wyckoff?

Tech A 2024-07-07 19:33

Tech C 2024-07-07 19:34

who is calling on 3cx can you check

Tech C 2024-07-07 19:34

i am on call cant pick up

Tech A 2024-07-07 19:34

no one

Tech E 2024-07-07 19:34

i'll call her back, it's platts

Tech C 2024-07-07 19:35

why they calling me

Tech C 2024-07-07 20:12

how u guys holding

Tech A 2024-07-07 20:13

HQ is a disaster. But I will deal with the consequences later

Tech C 2024-07-07 20:14

cant login to tea op3

Tech C 2024-07-07 20:14

someone locke dit

Tech D 2024-07-07 20:14

im on op3 i changed pass

Tech C 2024-07-07 20:14

what pass

Tech D 2024-07-07 20:15

Tech C 2024-07-07 20:16

gpu doesnt work on op4

Tech C 2024-07-07 20:18

ok restart helped

Tech D 2024-07-07 20:19

down to 5

image/png image.png

Tech C 2024-07-07 20:20

feels like we need another day

Tech A 2024-07-07 20:21

or two

Tech C 2024-07-07 20:21

or more then 3 people

Tech D 2024-07-07 20:21

op3 is working now, im not sure if anything else needs there

Tech C 2024-07-07 20:21

Alex did u get apps on op3

Tech D 2024-07-07 20:22

i put the password back to schein

Tech C 2024-07-07 20:22

for user?

Tech D 2024-07-07 20:22

yes

Tech C 2024-07-07 20:22

and they have shortcuts on desktop?

Tech D 2024-07-07 20:23

Tech C 2024-07-07 20:23

cool

Tech C 2024-07-07 20:23

i am runnin gthru all of them

Tech A 2024-07-07 20:28

so, whats the statius? are we done will allthe offices? I have 3 more PCs in HQ

Tech E 2024-07-07 20:35

i'm finish up platts.

Tech C 2024-07-07 20:38

no i am working on teaneck

Tech C 2024-07-07 20:38

and we didnt started wyckoff

Tech D 2024-07-07 20:44

Replication is also still getting cleaned up, I’m redoing site links explicitly

Tech C 2024-07-07 20:48

TEANECK DONEEEEEE

Tech C 2024-07-07 20:48

why 3cs calling me?

Tech E 2024-07-07 20:49

i took it, not sure why

Tech C 2024-07-07 20:49

who is next

Tech C 2024-07-07 20:49

i am not suppose to be in the q

Tech A 2024-07-07 20:49

wyckoff

Tech C 2024-07-07 20:50

i told u u need to take alook first

Tech C 2024-07-07 20:50

dexis messed up

Tech D 2024-07-07 20:50

who's suppose to answer calls ? its set to @Boris Dobronevsky from 3pm on sundays

Tech C 2024-07-07 20:50

what ?

Tech D 2024-07-07 20:50

its been like this for a looooooong time

Tech C 2024-07-07 20:50

this shit never called before

Tech D 2024-07-07 20:51

cus noone probably called after 3

Tech C 2024-07-07 20:51

so there is no reason for them to start

Tech E 2024-07-07 20:51

so i guess no one called after 3pm since Ross stays in the office until 5pm on sundays when he is not in field

Tech C 2024-07-07 20:52

whats the wyckoff ip again

Tech D 2024-07-07 20:53

172.17.174.11

Tech C 2024-07-07 20:53

tnx

Tech C 2024-07-07 20:54

i started wyckog from the end

Tech A 2024-07-07 20:54

Boris, whast wrong with Wyckoff again?

Tech C 2024-07-07 20:54

no dexis fld

Tech C 2024-07-07 20:54

and we have 2 active servers

Tech C 2024-07-07 20:58

\\wyck-svr\Dexis\DATA thats the path,but it doesnt exist

Tech C 2024-07-07 20:59

also cant find docs fld

Tech D 2024-07-07 21:00

oh wyck has 2 servers

Tech D 2024-07-07 21:00

one isnt done yet

Tech C 2024-07-07 21:00

so which one we using

Tech C 2024-07-07 21:00

the old one

Tech D 2024-07-07 21:01

i'm doingthe old one now, dexis is probably on it

Tech C 2024-07-07 21:01

also doc folders there

Tech A 2024-07-07 21:09

yes, Dexis is on the old server

Tech A 2024-07-07 21:09

@Alex Kaplun that server had to be demoted long time ago

Tech D 2024-07-07 21:09

yeah i know im joining it to domain

Tech A 2024-07-07 21:09

can you plz just join ut as a domain member so we dont have to do DExis migrationnow?

Tech A 2024-07-07 21:10

cool, thanks

Tech C 2024-07-07 21:14

what left other the wyckoff

Tech A 2024-07-07 21:19

thats the only office left

Tech C 2024-07-07 21:19

let me know when to begin

Tech C 2024-07-07 21:19

and its hard to believe 1 left yayayayayayayay

Tech C 2024-07-07 21:20

lets put bets how many call from pds tomorow

Tech A 2024-07-07 21:20

u can start, the server is back online

Tech D 2024-07-07 21:20

yay

image/png image.png

Tech E 2024-07-07 21:20

we may break record tomorrow with total calls thanks to this project

Tech A 2024-07-07 21:21

30-40

Tech A 2024-07-07 21:22

worst project so far. and HQ location is totally messed up

Tech A 2024-07-07 21:23

wyckoff PCs are redirected. what did you guys do to fix it?

Tech A 2024-07-07 21:23

manually?

Tech E 2024-07-07 21:24

gpupdate > relogin to windows

Tech A 2024-07-07 21:25

did not work

Tech C 2024-07-07 21:25

wait

Tech D 2024-07-07 21:25

redirect may need reboot

Tech C 2024-07-07 21:26

Alex fixed it

Tech C 2024-07-07 21:26

reboot should help

Tech C 2024-07-07 21:26

after reboot it goes to local flds

Tech E 2024-07-07 21:26

yes reboot actually, the remote apps was relogin.

Tech C 2024-07-07 21:26

so we pointing dexis to old svr?

Tech C 2024-07-07 21:27

what about docs

Tech A 2024-07-07 21:27

we dont have time to do the migration today unless you want to work on this for few more hours

Tech D 2024-07-07 21:27

wyck-svr is joined, but i need to reboot

Tech C 2024-07-07 21:28

where are docs folder?

Tech C 2024-07-07 21:28

i have one open shared on wyck svr

Tech C 2024-07-07 21:28

but i can see only myself inside

Tech A 2024-07-07 21:28

did not help

image/png image.png

Tech D 2024-07-07 21:28

\\WYCK-SVR.pdsmgmt.local\DOCS

Tech C 2024-07-07 21:29

ok Alex restart let us know when online

Tech D 2024-07-07 21:32

actually it may take few minutes, i'll wait for you then restart

Tech C 2024-07-07 21:35

i cant access docs fld

Tech A 2024-07-07 21:36

i can on fd1

Tech A 2024-07-07 21:36

check DNS

Tech D 2024-07-07 21:36

boris check make sure you loggedin to domain profile

Tech C 2024-07-07 21:39

ok works but i am not pointing op pcs

Tech C 2024-07-07 21:52

OP5

Tech D 2024-07-07 21:54

not working?

Tech A 2024-07-07 21:54

he, probably, tells which PC he is workgin on

Tech A 2024-07-07 21:54

so we dont bump into each other

Tech D 2024-07-07 21:54

oh ok

Tech A 2024-07-07 21:54

FD3

Tech C 2024-07-07 22:11

op4

Tech D 2024-07-07 22:16

we no longer need vpn DC-AWS ? im dismantling it?

Tech A 2024-07-07 22:17

im not sure. wanna wait for a few days?

Tech A 2024-07-07 22:23

op1

Tech A 2024-07-07 22:23

op2

Tech C 2024-07-07 22:24

u did op1 in 10 sec

Tech A 2024-07-07 22:27

im doing both

Tech C 2024-07-07 22:27

op3

Tech C 2024-07-07 22:28

op4 does updates forever

Tech C 2024-07-07 22:36

DONEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE

Tech C 2024-07-07 22:41

EMOTIONAL DAMAGE

Tech A 2024-07-07 22:58

not only... I think, i willbe hating 4 words till the rest of my days - administrator, D3, pdsmgmt.local and schein1!

Tech C 2024-07-07 23:01

true

Tech E 2024-07-07 23:05

Phil asked for admin rights to his profile in case he needs to help others.

Tech D 2024-07-07 23:06

(no text)

Tech C 2024-07-07 23:11

Michael asked to count how many hours each of us spent individually on this project

Tech A 2024-07-07 23:12

Feels like 5 years

Tech C 2024-07-07 23:12

Albert did u guys finish with Galigan

Tech E 2024-07-07 23:14

It was just dentrix. 3rd party apps not done and cs imaging is in August.

Tech F 2024-07-08 00:07

Are we sending Steve there tomorrow for day 3 to work on 3rd party apps?

Tech E 2024-07-08 00:10

No need because we have day 3 for carestream. Steve can work remotely if he has no other appointments to do these tasks because helpdesk will be busy.

Tech D 2024-07-08 00:35

i put redirection policy back its filtered for specific group in corporate ou the policy might be ignored if the folder already exist, renaming folder in \\redir$ ,then letting policy create folder and move renamed back in place should do the trick also this one might need a reboot to apply

image/png image.png

Tech A 2024-07-08 00:41

@Alex Kaplun i just tried on Brians PC and it didn't work. BMcliverty is the username

Tech A 2024-07-08 00:42

Unless it did not replicate it yet

Tech D 2024-07-08 00:43

do you see it in gpresult /r

Tech A 2024-07-08 00:44

Its there Corporate Folder Redirection

Tech A 2024-07-08 00:45

(no text)

image/png Image_20240707_204526.png

Tech D 2024-07-08 00:45

gpupdate /logoff /boot

Tech A 2024-07-08 00:46

Thats what i did. Gpupdate + reboot

Tech D 2024-07-08 00:46

but the foldes already there, i just renamed it, reboot again

Tech A 2024-07-08 00:48

Oh, i missed that part

Tech D 2024-07-08 00:49

so now it created the folder im moving items back

Tech A 2024-07-08 00:49

Yes, i checked the location, its pointed to the nas now

Tech A 2024-07-08 00:50

And yes, I see the files on the desktop now

Tech D 2024-07-08 00:50

1. existing \\redir$\%user% folder gets renamed 2. computer reboots creates \\redir$\%user% 3. move * from renamed folder to \\redir$\%user%

Tech A 2024-07-08 00:51

Okay, got it, thanks.

Tech C 2024-07-08 01:03

do u need me tom?

Tech A 2024-07-08 01:07

We need u all day every day, Borya!!

Tech C 2024-07-08 01:08

lol

---
title: "Fix Group Policy folder redirection causing RemoteApp failures and profile issues"
category: os-and-system
tags: ["group-policy", "folder-redirection", "remoteapp", "domain-controller", "replication"]
source_thread_id: "spaces/AAAA05BdS6s/threads/iQGj2QFKpHQ"
source_space: "spaces/AAAA05BdS6s"
generated_at: "2026-04-22T08:34:40"
participants: ["Tech A", "Tech B", "Tech C", "Tech D", "Tech E", "Tech F"]
---

# Fix Group Policy folder redirection causing RemoteApp failures and profile issues

## Problem

A Corporate Folder Redirection Group Policy was incorrectly applied to non-corporate users across multiple office locations, redirecting Desktop, Documents, and Pictures folders from local servers to a NAS (172.17.130.20). This caused two major issues:

1. **Missing RemoteApp shortcuts**: Users lost access to published applications (Dentrix, Dolphin, etc.) because shortcuts were redirected to the NAS instead of remaining on local profiles
2. **GPO processing failures**: `gpupdate /force` commands failed with errors reading `\\pdsmgmt.local\SysVol\pdsmgmt.local\Policies\{GUID}\gpt.ini` from domain controllers, preventing other Group Policies from applying correctly

The redirection policy was configured with "leave contents" on removal, making it impossible to automatically reverse through normal GPO updates even after the policy scope was corrected.

## Resolution

1. **Immediate fix for affected workstations**:
   - Manually redirect folders back to local server using registry:
     - Navigate to `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell`
     - Modify folder paths to point to local server (e.g., `\\tea-svr\docs$\username\Desktop`)
   - Reboot the workstation for registry changes to take effect

2. **Correct the Group Policy scope**:
   - Modify the Corporate Folder Redirection policy to apply only to specific corporate user groups
   - Wait for Active Directory replication to complete across all domain controllers
   - Monitor replication status in Group Policy Management Console

3. **For corporate users who should have redirection**:
   - Rename existing `\\redir$\%username%` folder temporarily
   - Run `gpupdate /logoff /boot` to force policy reapplication
   - Allow Group Policy to create new redirection folder structure
   - Move contents from renamed folder back to new folder structure

4. **Verify resolution**:
   - Run `gpresult /r` to confirm correct policies are applied
   - Check that RemoteApp shortcuts appear in Start Menu under Work Resources
   - Test that `gpupdate /force` completes without SysVol access errors

If domain controller replication is still in progress, wait for all DCs to sync before expecting policy changes to take effect on client workstations.

## References

- Source discussion: `spaces/AAAA05BdS6s/threads/iQGj2QFKpHQ`
- Attachments:
  - ![image.png](../attachments/iQGj2QFKpHQ.-J2ZUh5KtCY/image.png) — The image shows a Windows File Explorer window open to a network path: `\\tea-svr\docs$\TEA-FD01\Desktop`. The directory contains 44 items, including multiple file folders named with provider names and date ranges (e.g., "DR. MASER 06-28," "DR. JEONG 06-05"), along with Microsoft Excel workbooks (notably "751 PDS\_InventoryWorkbook\_Master-LO..." at 485 KB), a Word document ("cover sheet"), a PDF ("DESIGNEE FORM"), and several application shortcuts (Dentrix, Dolphin Imaging, EPSON Scan, Excel). No error messages, diagnostic codes, or hardware indicators are visible.
  - ![image.png](../attachments/iQGj2QFKpHQ.0pLJUZp8i6g/image.png)
  - ![image.png](../attachments/iQGj2QFKpHQ.2iN0y_IgOaI/image.png)
  - ![image.png](../attachments/iQGj2QFKpHQ.7AcgS_d2vFc/image.png) — **CMD window displaying `gpresult /r` output for user TEA-FD02 on domain PDSMGMT.**
  - ![image.png](../attachments/iQGj2QFKpHQ.DDN36Upg6GE/image.png) — **Group Policy Results (gpresult) output for user Brian McIliverty** (CN=Brian McIliverty, OU=Corporate, DC=pdsmgmt, DC=local). Group Policy was last applied **7/7/2024 at 12:39:02 PM** from server **HQ-SVR1.pdsmgmt.local**, with a slow link threshold of **500 kbps**, on domain **PDSMGMT** (Windows 2008 or later). Applied GPOs include: RemoteApps Distribution, Dentrix Shortcut, Dolphin Shortcut, EnableRemoteShortcutIcons, Pearl Shortcuts, and Map Dentrix Reports; Local Group Policy was filtered out as **Not Applied (Empty)**; user is a member of **Domain Users** and **Everyone**.
  - ![image.png](../attachments/iQGj2QFKpHQ.K0uBzOCR3BQ/image.png) — **Remote desktop session (LogMeIn) on workstation TEA-OP01 at PDS Teaneck – 751.**
  - ![image.png](../attachments/iQGj2QFKpHQ.YZEwBw1rDBQ/image.png) — A Remote Desktop Connection attempt is being made to **HQ-TSVR.pdsmgmt.local** under user **pdsmgmt\vsalazar**, but the security certificate warning dialog shows the certificate name returned by the remote computer is **HQ-SVR.hqrcms.local** — a mismatch from the target hostname. Two certificate errors are displayed: **"A revocation check could not be performed for the certificate"** and **"The certificate or associated chain is invalid (Code: 0x10000)"**.
  - ![image.png](../attachments/iQGj2QFKpHQ.b9rdiGCcxBg/image.png)
  - ![image.png](../attachments/iQGj2QFKpHQ.cI-GYoEkcrM/image.png) — **Windows PowerShell (Administrator) — `gpupdate /force` Output**
  - ![image.png](../attachments/iQGj2QFKpHQ.jb1nAv-1FCs/image.png)
  - ![image.png](../attachments/iQGj2QFKpHQ.lKhEwp9FlN4/image.png) — **Group Policy Management Console — pdsmgmt.local Domain Replication Status**
  - ![image.png](../attachments/iQGj2QFKpHQ.rmMfVZkjC_g/image.png)
  - ![Image_20240707_204526.png](../attachments/iQGj2QFKpHQ.rx1xM7wFXZU/Image_20240707_204526.png)
  - ![image.png](../attachments/iQGj2QFKpHQ.sgzIzoPGouc/image.png) — **CMD Window:** `gpupdate /force` was executed on host `TEA-OP01.PDSMGMT`; Computer Policy updated successfully, but User Policy failed with an error referencing inability to read `\\pdsmgmt.local\SysVol\pdsmgmt.local\Policies\{6F0E2F9A-85B4-4F43-920F-D333230277BB}\gpt.ini` from a domain controller.

Generated article

draft