Expand Issue 8 (NRPT lingering GPO) with GPO-hunt and source-side fixes

[emrcbrn]

What

Expands Issue 8 on the DNS troubleshooting page (Windows NRPT rule written but never effective, lingering GPO). We already covered the off-domain, empty-GPO case, but not how to actually find and fix the responsible Group Policy. This adds that depth:

• Two variants spelled out: a GPO that defines NRPT rules (overrides NetBird's local rule), and a legacy empty NRPT list left in registry.pol (still takes precedence, leaves no working rule).
• Diagnosis: check the DnsPolicyConfig registry container, then find the responsible GPO with gpresult /h and a SYSVOL registry.pol scan.
• Source-side fixes: the dummy-rule trick to clear an empty lingering container, plus guidance for when a GPO carries real NRPT rules.

Everything already in the section is preserved, and the heading/anchor is unchanged so existing links (the Windows client page and the Active Directory use-case page) keep resolving.

Adapted from the same Windows NRPT/GPO behavior documented for other clients; rewritten in NetBird's voice and framed around the NetBird client, not copied.

Screenshot

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Documentation
  • Expanded Windows NRPT troubleshooting guidance for cases where IP resolution works but match-domain resolution fails.
  • Added steps to compare written and effective policies, inspect local policy state, and identify conflicting Group Policy settings.
  • Added situation-specific remediation for stale policy entries, empty lingering lists, and real conflicting rules.

[coderabbitai]

📝 Walkthrough

Walkthrough

Issue 8 in the Windows DNS troubleshooting guide now documents NRPT symptoms, diagnostic commands, registry and GPO checks, and situation-specific remediation for stale or conflicting policy entries.

Changes

Windows NRPT troubleshooting

Layer / File(s)	Summary
NRPT diagnosis procedure src/pages/manage/dns/troubleshooting.mdx	Adds symptoms for off-domain or previously domain-joined machines, PowerShell comparisons of written and effective NRPT rules, registry checks, and GPO identification steps.
NRPT remediation guidance src/pages/manage/dns/troubleshooting.mdx	Describes cleanup for stale local containers, removal of empty lingering GPO entries, and handling GPOs with real NRPT rules that override NetBird resolution.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: sunsetdrifter

Poem

I’m a rabbit with a policy trail,
Chasing stale rules through every detail.
Registry checked, GPOs made clear,
Match-domain answers now draw near.
Hop, hop—NRPT is bright!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the NRPT troubleshooting expansion, including GPO investigation and source-side remediation.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install timed out. The project may have too many dependencies for the sandbox.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/pages/manage/dns/troubleshooting.mdx (1)

522-526: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Rename the $matches variable to avoid colliding with PowerShell's automatic variable.

In PowerShell, $matches is a built-in automatic variable used to store the results of the -match and -notmatch operators. While assigning to it works in a fresh session, it is considered a code smell and can cause unexpected behavior or script breakage if a user pastes this snippet into an existing session where regular expressions are being used.

Consider using a different name, such as $polFiles, to prevent conflicts.

♻️ Proposed refactor

- $matches = Get-ChildItem -Path $sysvolPath -Recurse -Filter "registry.pol" -File |
+ $polFiles = Get-ChildItem -Path $sysvolPath -Recurse -Filter "registry.pol" -File |
    Where-Object { (Get-Content -Path $_.FullName -Encoding Unicode) -like "*dnspolicyconfig*" }
  
- if ($matches) { "GPOs with NRPT rules:"; $matches.FullName }
+ if ($polFiles) { "GPOs with NRPT rules:"; $polFiles.FullName }
  else          { "No GPOs with NRPT rules found." }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/pages/manage/dns/troubleshooting.mdx` around lines 522 - 526, Rename the
PowerShell variable $matches to a non-reserved name such as $polFiles in the
Get-ChildItem pipeline and update the subsequent conditional and output
references consistently.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@src/pages/manage/dns/troubleshooting.mdx`:
- Around line 522-526: Rename the PowerShell variable $matches to a non-reserved
name such as $polFiles in the Get-ChildItem pipeline and update the subsequent
conditional and output references consistently.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: fecf7c29-5517-46c2-8c05-f27e714ae959

📥 Commits

Reviewing files that changed from the base of the PR and between 31f2b6c and 6d20dca.

📒 Files selected for processing (1)

• src/pages/manage/dns/troubleshooting.mdx