none
"Destination Folder Access Denied" "You'll need to provide administrator permission to copy to this folder" trying to update ADMX files

    Question

  • I have  two 2012 R2 domain controllers.  We do NOT use Central Store.  I found Win10 creator's update admx files online from Microsoft.  Following advice, I tried copying over the existing files in \windows\policydefinitions.  It copied some, but failed on a bunch of them with a window titled "Destination Folder Access Denied" with text inside "You'll need to provide administrator permission to copy to this folder". If I click Continue button, the same error message repeats.   I look this up and find forum posts

    https://social.technet.microsoft.com/Forums/windows/en-US/4b7ff5f3-e1ab-4749-831d-0cb745442505/rebuilding-offline-file-cache-created-via-group-policy?forum=w7itpronetworking

     saying I have to take ownership of the \PolicyDefinitions folder, using icacls etc.  So I tried all that, and I still get the same error.  Then when I opened up GPMC, I got a ton of errors due to not having the newer matching ADML files  from \EN-US, so I had the nightmare of having to note down which ADML files I had to copy (to match the certain ADMX files that successfully copied over), and got rid of that error.    I read another link which said just copy them to \windows\sysvol, but I stopped reading that as I noticed it pertained to using Central Store.

    First of all, I don't know why in the heck Microsoft makes it so hard to update ADMX files.  This is ridiculous.  Why won't they allow you to do a straight file copy?  I'm logged in as a domain admin even.  One shouldn't have to mess with icacls commands , permissions, etc.   And please don't tell me "setup Central Store" is a necessity as a solution.  We've had 2 DCs for years, and never had any problem, where we ever needed to implement Central Store.   I'm not even trying to run GPMC/edit GPO's from the 2nd domain controller, nor is any one else in my group trying to work with group policy.  I am the only one ever editing them.

    I assume it's because the files are in use, but that's just my guess.  I know with some applications, in similar circumstances, you can just stop a service or something and then be able to copy files, but I'm not reading that anywhere in relation to this error message, so I have no clue. 

    The ones that it successfully copied over are pictured below. I'm thinking most of these are newer win10CU files that didn't exist prior, but I'm not 100% sure...   Also, see the screenshot of what I see on the Summary tab when I do a Group Policy Results on a machine via the GPMC, though I believe we've seen that mismatch message for a long, long time though, so I don't know for sure, but I don't think that's an issue--(even a long running post (years) in technet forums about this indicates it's a bug, even up to server 2016)







    • Edited by dilbert2015 Tuesday, April 25, 2017 9:16 PM
    Tuesday, April 25, 2017 6:23 PM

All replies

  • Hi,
    >>   I read another link which said just copy them to \windows\sysvol, but I stopped reading that as I noticed it pertained to using Central Store.
    Based on my understanding, it means to copy the file on the DC locally, and then the files will be replicated to all DCs.
    In addition, after you take ownership of the folder, have you set the file to inherit from the parent? If not, please try it.
    Best regards, 
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Thursday, April 27, 2017 5:04 AM
    Moderator
  • Please be specific:

    "it means to copy the file on the DC locally" --->  What, do you mean to the \PolicyDefinitions folder ?   Or to \sysvol, which I thought pertains to Central Store, which I already stated that I don't want to use?  

    have you set the file to inherit from the parent? --->  It appears I did.  The perms on the \PolicyDefinitions folder show MyDomain\Domain Admins and MyDomain\Administrators both with Full Control for "This folder,subfolders and files".   A check of one ADMX shows MyDomain\Domain Admins and MyDomain\Administrators both with Full Control inherited from C:\Windows\PolicyDefinitions 

    Thursday, April 27, 2017 3:11 PM
  • Hi,
    Central Store location is %systemroot%\sysvol\domain\policies\PolicyDefinitions, local one is %systemroot%\PolicyDefinitions\ folder.
    Generally, taking ownership of PolicyDefinitions folder and sub folder would fix the similar problem.
    Not sure if it is due to Win10 creator's update or something else, based on my resarch, there is no more information on that, in this case, i would suggest you open up a case with Microsoft Technical Support as this will require indepth troubleshooting to determine what is happening.
    https://support.microsoft.com/en-us/contactus/?ws=support
    Best Regards,
    Wendy Jiang

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Monday, May 01, 2017 6:51 AM
    Moderator