none
Can't view/access Default Domain Policy

    Question

  • Hi All,

    I was going to make a change to our default domain policy and was greeted by the following error:

    "The following errors ere encountered

    An un unknown error occurred while data was gathered for this extension. Details: Access to the path \\[servername.domain]\sysvol\[domain]\Policies\{31b2f340-016d-11d2-945f}\adm is denied

    I am domain admin, and I don't have read permissions to view the Default Domain Policy

    How do I regain full access to the Default Domain Policy?

    Thanks in advance

    Tuesday, November 29, 2016 4:02 PM

Answers

  • Hi,

    Please check if you could open the following folder path for default domain policy GPO

    %SystemRoot%\SYSVOL\sysvol\DomainName\Policies\ {31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini

    Then check if the permission is correct.

    In addition, sometime, it might be caused by corrupted GPO, you could also start troubleshooting from this aspect. Please see:

    http://serverfault.com/questions/281815/default-domain-policy-corrupted

    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

    Best regards,

    Wendy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Marked as answer by Zakmk96 Wednesday, December 7, 2016 3:37 PM
    Monday, December 5, 2016 2:05 AM
    Moderator

All replies

  • Hi,
    For me, I would verify if my account is still in domain admin group, and maybe, someone changed its membership by accident.
    And you could have a try again using another administrator account and see if the same error appear.
    If that account is working, then you could use it to delegate the permission of default domain policy GPO, please see:
    Tip: Delegate Control to Users to Work with GPOs
    https://technet.microsoft.com/en-us/library/gg416506.aspx
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Wednesday, November 30, 2016 2:43 AM
    Moderator
  • Hi,

    Did you upgraded the AD from legacy to the later 2012/2012R2 Operating system?

    Wednesday, November 30, 2016 10:39 AM
  • The server AD is on is W2K12 server
    Wednesday, November 30, 2016 2:14 PM
  • I made myself and another account administrators and still see the same error. All groups that have read/ or write permissions to the Default domain policy I am a member of.

    Thursday, December 1, 2016 9:24 AM
  • Hi,

    Please check if you could open the following folder path for default domain policy GPO

    %SystemRoot%\SYSVOL\sysvol\DomainName\Policies\ {31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini

    Then check if the permission is correct.

    In addition, sometime, it might be caused by corrupted GPO, you could also start troubleshooting from this aspect. Please see:

    http://serverfault.com/questions/281815/default-domain-policy-corrupted

    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.

    Best regards,

    Wendy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Marked as answer by Zakmk96 Wednesday, December 7, 2016 3:37 PM
    Monday, December 5, 2016 2:05 AM
    Moderator
  • I am not able to view the file (so I don't believe I have read permissions), however I was able to access the permissions table for that file and I have full control, two other groups I am a part of have full control, and another group I am a part of has Read and Execute permissions.
    Monday, December 5, 2016 10:03 AM
  • Hi,
    Appreciate you for marking the reply as answers, can I think the problem is going well?
    And if you have any update or feedback, you could share to us. If you still have any questions, please also feel free to contact us.
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Thursday, December 8, 2016 1:26 AM
    Moderator