#Requires -Version 5.1
<#
    JbTecWiz Support Centre -- generated fix script

    Fault : Group Policy events 1058 and 1030 -- cannot read gpt.ini
    Fix   : Restore the SYSVOL path and its DFS namespace
    Source: https://jbtecwiz.com/support/srv-gpo-1058

    Run as     : Elevated PowerShell
    Expect     : 45 minutes
    Risk       : medium
    Reversible : yes

    WHEN THIS IS THE RIGHT FIX
    The domain-based path does not resolve or open.

    HOW TO UNDO IT
    None -- this restores expected state.

    This script walks the fix one step at a time and asks before each
    one. Steps with no command are things you do yourself -- it prints
    those and waits. Run with -DryRun to print without executing.

    --------------------------------------------------------------------
    NO WARRANTY - USE AT YOUR OWN RISK

    This script is provided by JbTecWiz as-is and with no warranty of any
    kind, express or implied. You run it entirely at your own risk.

    JbTecWiz accepts no liability for any loss or damage arising from its
    use, including but not limited to data loss, downtime, or configuration
    changes that turn out to be wrong for your system.

    You are responsible for reading this script before running it, for
    satisfying yourself that it suits the machine in front of you, and for
    having a working backup first. Some steps cannot be undone.
    --------------------------------------------------------------------
#>

[CmdletBinding()]
param(
    # Print every step and command without running anything.
    [switch]$DryRun,
    # Do not ask before each step. Read the script first if you use this.
    [switch]$Unattended
)

$ErrorActionPreference = 'Stop'
$script:Failed = 0

function Write-Rule { param([string]$Text)
    Write-Host ''
    Write-Host ('-' * 70) -ForegroundColor DarkGray
    if ($Text) { Write-Host $Text -ForegroundColor Cyan }
}

function Show-Prose { param([string]$Text, [string]$Colour = "Gray")
    if (-not $Text) { return }
    $words = $Text -split "\s+"; $line = "  "
    foreach ($w in $words) {
        if (($line.Length + $w.Length) -gt 74) { Write-Host $line -ForegroundColor $Colour; $line = "  " }
        $line += "$w "
    }
    if ($line.Trim()) { Write-Host $line -ForegroundColor $Colour }
}

function Invoke-Step {
    param(
        [int]$Number, [string]$Do, [string]$Why,
        [scriptblock]$Command, [switch]$Manual, [string]$Shell = "powershell"
    )
    Write-Rule "  Step $Number of 6"
    Show-Prose $Do "White"
    if ($Why) { Write-Host ""; Show-Prose $Why "DarkGray" }

    if ($Manual) {
        Write-Host ''
        Write-Host '  -> Do this yourself, then press Enter to carry on.' -ForegroundColor Yellow
        if (-not $Unattended -and -not $DryRun) { [void](Read-Host) }
        return
    }

    Write-Host ''
    foreach ($l in ($Command.ToString().Trim() -split "`n")) {
        Write-Host ("    " + $l.Trim()) -ForegroundColor Green
    }
    Write-Host ''

    if ($DryRun) { Write-Host "  (dry run -- not executed)" -ForegroundColor DarkGray; return }
    if (-not $Unattended) {
        $a = Read-Host "  Run this step? [Y]es / [S]kip / [Q]uit"
        if ($a -match "^[Qq]") { Write-Host "  Stopped at your request."; exit 0 }
        if ($a -match "^[Ss]") { Write-Host "  Skipped." -ForegroundColor DarkGray; return }
    }
    try { & $Command }
    catch {
        $script:Failed++
        Write-Host ("  Step $Number failed: " + $_.Exception.Message) -ForegroundColor Red
        Show-Prose "The rest of the fix may depend on this. Read the write-up before carrying on." "Red"
        if (-not $Unattended) {
            $c = Read-Host "  Carry on anyway? [y/N]"
            if ($c -notmatch "^[Yy]") { exit 1 }
        }
    }
}

Write-Rule
Write-Host '  Group Policy events 1058 and 1030 -- cannot read gpt.ini' -ForegroundColor White
Write-Host '  Restore the SYSVOL path and its DFS namespace' -ForegroundColor Cyan
Write-Host ''
Write-Host '  Risk: medium   Reversible   45 minutes'
Write-Host ''
Show-Prose 'No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.' 'DarkYellow'
Write-Rule

if (-not $Unattended -and -not $DryRun) {
    $go = Read-Host '  Ready? [y/N]'
    if ($go -notmatch "^[Yy]") { Write-Host "  Nothing was changed."; exit 0 }
}

Invoke-Step -Number 1 -Do 'Test both forms of the path from the client. The difference tells you whether it is DFS or the share.' -Why 'The domain form goes through the DFS namespace and needs the DFS Namespace service and a working domain referral; the server form is a plain SMB share. Which one fails narrows this immediately.' -Command {
    Test-Path \\example.local\SYSVOL\example.local\Policies
    Test-Path \\DC01\SYSVOL\example.local\Policies
}

Invoke-Step -Number 2 -Do 'On the DC, confirm SYSVOL and NETLOGON are actually shared.' -Command {
    Get-SmbShare | Where-Object Name -in 'SYSVOL','NETLOGON' | Format-Table Name, Path, Description -AutoSize
    net share
}

Invoke-Step -Number 3 -Do 'If they are missing, SYSVOL has not finished its initial replication -- check for the SYSVOL ready flag.' -Command {
    Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters' -Name SysvolReady
}

Invoke-Step -Number 4 -Do 'Confirm the DFS Namespace service is running on every DC.' -Command {
    Get-Service Dfs, DFSR, Netlogon | Format-Table Name, Status, StartType -AutoSize
}

Invoke-Step -Number 5 -Do 'Re-register the DC''s records and restart Netlogon, which republishes the referral.' -Command {
    nltest /dsregdns
    Restart-Service Netlogon
}

Invoke-Step -Number 6 -Do 'Test policy application on the client.' -Command {
    gpupdate /force
    gpresult /r
}

Write-Rule "  Confirm it worked"
Show-Prose 'gpresult lists the policies as applied and 1058 stops recurring.' 'White'
Write-Host ''
if (-not $DryRun) {
    gpresult /h C:\temp\gpo.html
}

Write-Rule
if ($script:Failed -gt 0) {
    Write-Host ("  Finished with " + $script:Failed + " failed step(s).") -ForegroundColor Yellow
    Show-Prose 'Read the full write-up at https://jbtecwiz.com/support/srv-gpo-1058' 'Yellow'
} else {
    Write-Host '  Finished.' -ForegroundColor Green
}
Write-Host ''
Show-Prose 'To undo: None -- this restores expected state.' 'DarkGray'
Write-Rule