none
Not able to save changes

    Question

  • When I try to save a change to a GPO it gives me one of two error messages and it appears that the changes have been made but if you exit and go back in they are reverted. 

    As soon as my account is verified I will be able to post a picture of the error message.

    Wednesday, December 21, 2016 10:21 AM

Answers

  • Hi,
    Are there any related event logs in the event viewer? And have you checked if the DC is working in health? You could run the following files on it for more details:
    ipconfig /all >c:\ipconfig.txt
    dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt
    repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt 
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Marked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    Monday, January 02, 2017 2:28 AM
    Moderator
  • Hi Josh,
    Sorry that we could not open the link due to lack of the google account, and you could share it in the OneDrive.
    In addition, please choose a problematic GPO and check if you could open in the sysvol folder directly, it will help us check if the sysvol is corrupted.
    If corrupted, maybe, we need to rebuild it then: https://technet.microsoft.com/en-us/library/cc816596(v=ws.10).aspx
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Marked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    Monday, January 09, 2017 4:35 AM
    Moderator
  • UPDATE

    Problem solved. I believe the fix was to remove the "Authenticated Users" from the Delegation tab. Also a system reboot might have helped also.

    Thank you very much to Wendy and Martin who put up with my lack of Windows Server 2008 r2 knowledge.

    • Marked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    Wednesday, January 11, 2017 11:56 AM

All replies

  • Hi,
    Waiting for the screenshot of the detail error message for better troubleshooting. You could also check if there are any errors in event viewer.
    And for me, I would firstly check the account permission for editing the GPO.
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Thursday, December 22, 2016 2:18 AM
    Moderator
  • Thank you for your response Wendy. I'm still waiting for them to verify my account. I believe the problem is which policies are being used. It looks like local policies are dominate and I don't know where to look or how to really tell.

    Thanks for your help.

    Thursday, December 22, 2016 3:41 AM
  • > When I try to save a change to a GPO it gives me one of two error messages and it appears that the changes have been made but if you exit and go back in they are reverted.
     
    In most dialog boxes in Windows, you can press ctrl-c to copy all string content to the clipboard, then in a new forum post press ctrl-v to insert :)
     
    Thursday, December 22, 2016 9:07 AM
  • See the end of this message for details on invoking 
    just-in-time (JIT) debugging instead of this dialog box.

    ************** Exception Text **************
    System.ArgumentException: Value does not fall within the expected range.
       at Microsoft.GroupPolicy.AdmTmplEditor.IGPMAdmTmplEditorCallback.ApplyChanges()
       at Microsoft.GroupPolicy.AdmTmplEditor.Editor.SaveChanges()
       at Microsoft.GroupPolicy.AdmTmplEditor.Editor.buttonOK_Click(Object sender, EventArgs e)
       at System.Windows.Forms.Control.OnClick(EventArgs e)
       at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
       at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
       at System.Windows.Forms.Control.WndProc(Message& m)
       at System.Windows.Forms.ButtonBase.WndProc(Message& m)
       at System.Windows.Forms.Button.WndProc(Message& m)
       at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
       at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)


    ************** Loaded Assemblies **************
    mscorlib
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.5485 (Win7SP1GDR.050727-5400)
        CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v2.0.50727/mscorlib.dll
    ----------------------------------------
    Microsoft.GroupPolicy.AdmTmplEditor
        Assembly Version: 6.1.0.0
        Win32 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
        CodeBase: file:///C:/Windows/assembly/GAC_64/Microsoft.GroupPolicy.AdmTmplEditor/6.1.0.0__31bf3856ad364e35/Microsoft.GroupPolicy.AdmTmplEditor.dll
    ----------------------------------------
    System
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.8686 (QFE.050727-8600)
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll
    ----------------------------------------
    System.Windows.Forms
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.5491 (Win7SP1GDR.050727-5400)
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
    ----------------------------------------
    System.Drawing
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.5495 (Win7SP1GDR.050727-5400)
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
    ----------------------------------------
    System.Xml
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.5494 (Win7SP1GDR.050727-5400)
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Xml/2.0.0.0__b77a5c561934e089/System.Xml.dll
    ----------------------------------------
    Accessibility
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.5483 (Win7SP1GDR.050727-5400)
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Accessibility/2.0.0.0__b03f5f7f11d50a3a/Accessibility.dll
    ----------------------------------------

    ************** JIT Debugging **************
    To enable just-in-time (JIT) debugging, the .config file for this
    application or computer (machine.config) must have the
    jitDebugging value set in the system.windows.forms section.
    The application must also be compiled with debugging
    enabled.

    For example:

    <configuration>
        <system.windows.forms jitDebugging="true" />
    </configuration>

    When JIT debugging is enabled, any unhandled exception
    will be sent to the JIT debugger registered on the computer
    rather than be handled by this dialog box.
    Thursday, December 22, 2016 9:55 AM
  • **UPDATE**

    When I run RSoP, and I navigate to lets say password policies on computer configuration, I can see that under Source GPO it has Default Domain Policy listed. When I then go to GPMC and edit my Default Domain Policy / Computer Configuration / Policies / Windows Settings / Security Settings / Account Policies / Password Policy / Enforce password history properties to "0" and save the changes. I then get an error message

    (White box named Security Templates) 

    The parameter is incorrect.

    Failed to save \\(DC)\sysvol\(DC)\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows\NT\Secedit\GptTmpl.inf. Make sure that this object exists.

    Then I click ok a few times and it looks like it was accepted as a change but when you close GPMC and then go back in and the changes were not saved.

    Any ideas?

    I have checked that the inf files are there and that Administrators have full permissions.


    Thursday, December 22, 2016 12:42 PM
  • > Failed to save \\(DC)\sysvol\(DC)\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows\NT\Secedit\GptTmpl.inf. Make sure that this object exists.
     
    Make sure this file exists on ALL Domain Controllers (replace \\domain\sysvol with \\domain controller\sysvol for all DCs) and that it is identical in terms of size and content.
     
    Thursday, December 22, 2016 1:03 PM
  • Thank you for your help Martin. I'm not sure I know what you mean when you say "replace \\domain\sysvol with \\domain controller\sysvol for all DCs) and that it is identical in terms of size and content."

    Sorry for my ignorance.

    Thursday, December 22, 2016 10:55 PM
  • Martin asked you to check if this GPO is existing in Sysvol of all DC's in your Domain and also check if you are able to edit/save that inf file using a notepad

    for eg:-

    \\DC1\sysvol\Domain Name\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows\NT\Secedit\GptTmpl.inf.

    \\DC2\sysvol\Domain Name\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows\NT\Secedit\GptTmpl.inf.



    Regards, Nidhin.CK

    Friday, December 23, 2016 4:19 AM
  • Ah ok thanks for the clarification. I can edit and save the GptTmpl.inf files without any problem.

    I still get this message...

    (White box named Security Templates) 

    The parameter is incorrect.

    Failed to save \\(DC)\sysvol\(DC)\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows\NT\Secedit\GptTmpl.inf. Make sure that this object exists.

    When trying to edit/save computer configuration policies.

    I get this.... when trying to edit/save user policies.

    Unhandled exception has occurred in a component in your application. If you click Continue, the application will ignore this error and attempt to continue.

    Value does not fall within the expected range.

    See the end of this message for details on invoking 
    just-in-time (JIT) debugging instead of this dialog box.

    ************** Exception Text **************
    System.ArgumentException: Value does not fall within the expected range.
       at Microsoft.GroupPolicy.AdmTmplEditor.IGPMAdmTmplEditorCallback.ApplyChanges()
       at Microsoft.GroupPolicy.AdmTmplEditor.Editor.SaveChanges()
       at Microsoft.GroupPolicy.AdmTmplEditor.Editor.buttonApply_Click(Object sender, EventArgs e)
       at System.Windows.Forms.Control.OnClick(EventArgs e)
       at System.Windows.Forms.Button.OnMouseUp(MouseEventArgs mevent)
       at System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
       at System.Windows.Forms.Control.WndProc(Message& m)
       at System.Windows.Forms.ButtonBase.WndProc(Message& m)
       at System.Windows.Forms.Button.WndProc(Message& m)
       at System.Windows.Forms.Control.ControlNativeWindow.WndProc(Message& m)
       at System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)


    ************** Loaded Assemblies **************
    mscorlib
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.5485 (Win7SP1GDR.050727-5400)
        CodeBase: file:///C:/Windows/Microsoft.NET/Framework64/v2.0.50727/mscorlib.dll
    ----------------------------------------
    Microsoft.GroupPolicy.AdmTmplEditor
        Assembly Version: 6.1.0.0
        Win32 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850)
        CodeBase: file:///C:/Windows/assembly/GAC_64/Microsoft.GroupPolicy.AdmTmplEditor/6.1.0.0__31bf3856ad364e35/Microsoft.GroupPolicy.AdmTmplEditor.dll
    ----------------------------------------
    System
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.8686 (QFE.050727-8600)
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System/2.0.0.0__b77a5c561934e089/System.dll
    ----------------------------------------
    System.Windows.Forms
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.5491 (Win7SP1GDR.050727-5400)
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Windows.Forms/2.0.0.0__b77a5c561934e089/System.Windows.Forms.dll
    ----------------------------------------
    System.Drawing
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.5495 (Win7SP1GDR.050727-5400)
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Drawing/2.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll
    ----------------------------------------
    MMCEx
        Assembly Version: 3.0.0.0
        Win32 Version: 6.1.7600.16385
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/MMCEx/3.0.0.0__31bf3856ad364e35/MMCEx.dll
    ----------------------------------------
    MMCFxCommon
        Assembly Version: 3.0.0.0
        Win32 Version: 6.1.7600.16385
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/MMCFxCommon/3.0.0.0__31bf3856ad364e35/MMCFxCommon.dll
    ----------------------------------------
    System.Configuration
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.5483 (Win7SP1GDR.050727-5400)
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Configuration/2.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll
    ----------------------------------------
    System.Xml
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.5494 (Win7SP1GDR.050727-5400)
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/System.Xml/2.0.0.0__b77a5c561934e089/System.Xml.dll
    ----------------------------------------
    dnscmmc
        Assembly Version: 6.1.0.0
        Win32 Version: 6.1.7600.16385 (win7_rtm.090713-1255)
        CodeBase: file:///C:/Windows/system32/dnscmmc.DLL
    ----------------------------------------
    Accessibility
        Assembly Version: 2.0.0.0
        Win32 Version: 2.0.50727.5483 (Win7SP1GDR.050727-5400)
        CodeBase: file:///C:/Windows/assembly/GAC_MSIL/Accessibility/2.0.0.0__b03f5f7f11d50a3a/Accessibility.dll
    ----------------------------------------

    ************** JIT Debugging **************
    To enable just-in-time (JIT) debugging, the .config file for this
    application or computer (machine.config) must have the
    jitDebugging value set in the system.windows.forms section.
    The application must also be compiled with debugging
    enabled.

    For example:

    <configuration>
        <system.windows.forms jitDebugging="true" />
    </configuration>

    When JIT debugging is enabled, any unhandled exception
    will be sent to the JIT debugger registered on the computer
    rather than be handled by this dialog box.

    Thanks again for all your help.

    Friday, December 23, 2016 11:29 AM
  • Hi,
    >> Unhandled exception has occurred in a component in your application. If you click Continue, the application will ignore this error and attempt to continue.
    As far as I know, Just-In-Time (JIT) errors are typically related to the issues with Microsoft .NET Framework, in this case, please have a try to repair or reinstall .NET Framework, then see if it error is gone.
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Monday, December 26, 2016 1:54 AM
    Moderator
  • Thanks for the suggestion Wendy. I tried reinstalling 4.6.2 and that didn't help. So then I installed 4.5.2 and that didn't help either.
    Monday, December 26, 2016 9:59 AM
  • I think I might have found the problem....or maybe not. 

    I don't see the Registry.pol file in any of the \\Innovativeserve\sysvol\corp.imsaz.co\Policies folders. 

    Maybe I'm wrong in thinking that each GPO is supposed to have a Registry.pol file associated with it.

    If I'm correct does anybody know how to "fix" this?

    Monday, December 26, 2016 3:08 PM
  • Hi,

    Could any related events be found in the event viewer? And what operating system is the DC running?

    Please take a look at the following KB and try if it works:

    You cannot edit GPO and the Registry.pol file is not replicated when locked in Windows Server 2008 R2 or Windows Server 2012

    https://support.microsoft.com/en-sg/kb/2791372

    Best regards,

    Wendy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Thursday, December 29, 2016 1:50 AM
    Moderator
  • Thanks Wendy I will try that.

    I have also found this to be true....

    Create a new GPO with any alterations - settings are retained and applied

    Edit an existing GPO - setting will not "save"

    I have looked over Permissions on the SYSVOL folder, the Registry Key Folders, GPO scope, delegation....

    Friday, December 30, 2016 4:41 PM
  • It is Windows Server 2008 R2

    The Hot Fix did not work.

    Friday, December 30, 2016 5:47 PM
  • Hi,
    Are there any related event logs in the event viewer? And have you checked if the DC is working in health? You could run the following files on it for more details:
    ipconfig /all >c:\ipconfig.txt
    dcdiag /v /c /d /e /s:dcname >c:\dcdiag.txt
    repadmin /showrepl dc* /verbose /all /intersite >c:\repl.txt 
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Marked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    Monday, January 02, 2017 2:28 AM
    Moderator
  • Thank you for the suggestion. I ran the commands and here are the result links to my google docs.

    dcdiag 

    ipconfig /all

    repl

    I didn't see anything that stuck out to me, but that doesn't mean much.

    Hope you have some time to review. 

    Thanks again so much for everyone's help.

    -Josh

    • Marked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    • Unmarked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    Thursday, January 05, 2017 1:26 PM
  • Hi Josh,
    Sorry that we could not open the link due to lack of the google account, and you could share it in the OneDrive.
    In addition, please choose a problematic GPO and check if you could open in the sysvol folder directly, it will help us check if the sysvol is corrupted.
    If corrupted, maybe, we need to rebuild it then: https://technet.microsoft.com/en-us/library/cc816596(v=ws.10).aspx
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Marked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    Monday, January 09, 2017 4:35 AM
    Moderator
  • I'm sorry I thought that was public. Let me try OneDrive.

    When you say "Open in the sysvol folder directly" do you mean edit it with notepad or something?

    • Marked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    • Unmarked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    Monday, January 09, 2017 11:11 PM
  • repl

    ipconfig

    dcdiag

    sorry for the delay

    • Marked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    • Unmarked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    Tuesday, January 10, 2017 1:19 PM
  • UPDATE

    Problem solved. I believe the fix was to remove the "Authenticated Users" from the Delegation tab. Also a system reboot might have helped also.

    Thank you very much to Wendy and Martin who put up with my lack of Windows Server 2008 r2 knowledge.

    • Marked as answer by IMS Josh Wednesday, January 11, 2017 11:56 AM
    Wednesday, January 11, 2017 11:56 AM
  • Hi,
    Great news, and we also thank you for the update and share, it will be greatly helpful to others who have the same question.
    Appreciate for your feedback.
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Thursday, January 12, 2017 1:40 AM
    Moderator