Frontpage
Forums
Tutorials
Members
Calendar
Subscription
Donate
Links
Contact 
Help
Hello
I have an AD for my domain. But when I create a Group Policy Object for an OU, I always get Access Denied error message even I log as administrator.
I am sure that I log as administrator. I can not find the solution.
You help is strongly appreciated
Thank you
Page 1 of 1
Group Policy Object creating error
Error Access Denied while creating GPO
Rate Topic:
Back to top
#2
Posted 13 June 2005 - 08:49 AM
hi
can u edit the default GPO for the domain controller? do u have permission for that? by the way check the Built-in security groups, maybe the administrator account has been removed from the "Administrator" and User accounts security groput.
can u edit the default GPO for the domain controller? do u have permission for that? by the way check the Built-in security groups, maybe the administrator account has been removed from the "Administrator" and User accounts security groput.
#3
Posted 15 June 2005 - 03:09 AM
I can edit the Default Group Policy for the domain but before I can do it displays many message as in the picture. I checked the security group Administrators my account is still the member of it. I just disable the policy "Password must meet the complexity" and rename "Administrator" built-in account to adminPtcComputer.
Attached File(s)
#4
- Professor
-
- Group: Members
- Posts: 427
- Joined: 15-June 04
Posted 15 June 2005 - 05:47 AM
Apply this hotfix for the string problem http://support.microsoft.com/default.aspx?...kb;en-us;842933
as per permissions, I think you need to restore default permissions to the gpo ... check the permissions on the default domain policy folder that starts with 6ac within your sysvol ...
as per permissions, I think you need to restore default permissions to the gpo ... check the permissions on the default domain policy folder that starts with 6ac within your sysvol ...
#5
Posted 15 June 2005 - 06:59 AM
oh i think u have a big problem in ur network!!!
as u know, troubleshooting the network problems like this are very complicated and actually there are many possible things that can cause these errors; u should think carefully; which setting u changed in other related services? do u have IIS and are change the settings in IE that can alert u for security pages?
by the way cause u change the administrator account name, may be this be problem. try to back it to Administrator {default] and then test for examin the problems; may be they solve.
by the way keep in mind that u shouldn't rename the administrator account after configuration of server critical services like IIS or other.
as u know, troubleshooting the network problems like this are very complicated and actually there are many possible things that can cause these errors; u should think carefully; which setting u changed in other related services? do u have IIS and are change the settings in IE that can alert u for security pages?
by the way cause u change the administrator account name, may be this be problem. try to back it to Administrator {default] and then test for examin the problems; may be they solve.
by the way keep in mind that u shouldn't rename the administrator account after configuration of server critical services like IIS or other.
#6
Posted 16 June 2005 - 05:23 AM
thank you Klasika and CrescendoBeat.
I can resolve the problem by http://support.micro...kb;en-us;842933 but the Access Denied Error when I create group policy can not be solved.
I renamed the adminPtcComputer account back to "Administrator" and I have no IIS on my PDC.
I checked the permission of domain policy folder {6AC1786C-016F-11D2-945F-00C04fB984F9} in the sysvol, the Administrator account, Administrators group have full contorl permission.
The only thing I do on policy is configure the "Password must meet complexity" and "Minimum Password Length". I configure it back to undefined but it stay the same.
I have never install program on my PDC except the McAfee anti-virus.
I can resolve the problem by http://support.micro...kb;en-us;842933 but the Access Denied Error when I create group policy can not be solved.
I renamed the adminPtcComputer account back to "Administrator" and I have no IIS on my PDC.
I checked the permission of domain policy folder {6AC1786C-016F-11D2-945F-00C04fB984F9} in the sysvol, the Administrator account, Administrators group have full contorl permission.
The only thing I do on policy is configure the "Password must meet complexity" and "Minimum Password Length". I configure it back to undefined but it stay the same.
I have never install program on my PDC except the McAfee anti-virus.
Attached File(s)
-
08.GIF (16.34K)
Number of downloads: 8
#7
Posted 16 June 2005 - 05:29 AM
I also have test another way.
First I promote one PC to be a domain controller (for new domain), and I go to Active Directory to create Group Policy Object for an OU, it works properly without any errors.
After that I remove Active Directory from that PC and I try to make it as BDC for my PDC. Now it is also get the error as the PDC. It get the Access Denied error too.
First I promote one PC to be a domain controller (for new domain), and I go to Active Directory to create Group Policy Object for an OU, it works properly without any errors.
After that I remove Active Directory from that PC and I try to make it as BDC for my PDC. Now it is also get the error as the PDC. It get the Access Denied error too.
#8
Posted 19 June 2005 - 04:31 AM
hi
this is the final steps that u can do, if these doesn't solved ur problem u should change the Windows Server.
Check the Security tab of the OU and check for any necessary configure;
then be sure that the admin account be the member of "Group Policy Creator Owners" and this group itself be a member of "Administrators" security group.
by the way for any question u can call Microsoft Support Center and they answer u; if u wanted the last option is this.
Phone NO. +1 800 936 4900
this is the final steps that u can do, if these doesn't solved ur problem u should change the Windows Server.
Check the Security tab of the OU and check for any necessary configure;
then be sure that the admin account be the member of "Group Policy Creator Owners" and this group itself be a member of "Administrators" security group.
by the way for any question u can call Microsoft Support Center and they answer u; if u wanted the last option is this.
Phone NO. +1 800 936 4900
#9
- Professor
-
- Group: Members
- Posts: 427
- Joined: 15-June 04
Posted 21 June 2005 - 12:57 AM
That has something to do with permissions ... anyway, this tool works on Win2k (I haven't tried it on Win2k3), and should create default GPO on the server. Make sure you test it before you apply it ...
Attached File(s)
-
recreateDefPol.zip (34.88K)
Number of downloads: 14
#10
Posted 27 July 2005 - 08:45 AM
Hi all,
First at all, i want to apologize my very poor english.
The same problem make crazy for about a few days.
The problem is an Access Protection policy of the McAfee antivirus. (i recently installed versión 8.0 of VirusScan Enterprise)
You need to open Acces Protection Properties from de VirusScan console and uncheck the item "Prevent remote creation/modification/deletion of files in the Windows folder and subfolders (.ini)". Thats all.
I want that tip solve your problem.
Regards,
Javier Toledo
First at all, i want to apologize my very poor english.
The same problem make crazy for about a few days.
The problem is an Access Protection policy of the McAfee antivirus. (i recently installed versión 8.0 of VirusScan Enterprise)
You need to open Acces Protection Properties from de VirusScan console and uncheck the item "Prevent remote creation/modification/deletion of files in the Windows folder and subfolders (.ini)". Thats all.
I want that tip solve your problem.
Regards,
Javier Toledo
Attached File(s)
-
Dibujo.JPG (47.51K)
Number of downloads: 4
#11
- How do you like your Chili?
-
- Group: Members
- Posts: 995
- Joined: 16-February 05
Posted 27 July 2005 - 11:57 AM
Are you getting any specific errors in your event log?
Is your TCP/IP NetBIOS helper service running?
Is your TCP/IP NetBIOS helper service running?
Share this topic:
Page 1 of 1