none
GPO related error: EnableSSL3Fallback

    Question

  • Hello,

    I created two GPOs in Windows 2008 R2 (all updates applied)

    When I click in "Policies" , a error message pops up (see image bellow)

    I tried opening the two policies and even the "Default domain" policy every time resulting in that message popping up, always when expanding "Policies" , whether the User node or the Computer node of the GPO.

    Somebody gave me this piece of advice:

     "... Have you tried to replace the admx policy file? You can get them from here: https://www.microsoft.com/en-us/down...s.aspx?id=6243

    Copy the existing inetres.admx file from the ..\windows\policydefinitions folder to a safe place. You may also need to take ownership of the admx file before you can replace it.

    All taken from ElderN's reply here: http://answers.microsoft.com/en-us/w...f-7b070a5db531 ..."

    I did what he suggested, with no results.

    The thing is that it is happening in both Domain Controllers, so I assume it has nothing to do with the local file system.


    • Edited by Luis O.J Tuesday, December 06, 2016 8:43 AM Better tittle for the post
    Thursday, December 01, 2016 11:38 AM

Answers

All replies

  • >  "... Have you tried to replace the admx policy file? You can get them from here: https://www.microsoft.com/en-us/down...s.aspx?id=6243 <https://www.microsoft.com/en-us/download/details.aspx?id=6243>
     
    You also need to take care of the ADML file... Or simply edit the ADMX and remove the node that contains the SSL3 Fallback definition (unless you desperately need that special setting, of course :-) )
     
    Thursday, December 01, 2016 12:23 PM
  • Thanks Martin.

    Yes, I tried to replace them by downloading it from Microsoft and running the .msi file.

    The thing is that, as I said, it happens in both Domain Controllers, so, I think it has little to do with the file system, corruptions or the alike. Both servers are fully updated.

    I didnt understand the ADML file part.

    What do you mean by "node" ?

    Sorry, I am not an expert yet.


    Luis Olías.

    Thursday, December 01, 2016 12:34 PM
  • > Yes, I tried to replace them by downloading it from Microsoft and running the .msi file.
     
    Running the MSI does NOT update your PolicyDefinitions. You must copy the resulting folders manually.
     
    Thursday, December 01, 2016 12:43 PM
  • Where can I see the resulting folders?, Where do I have to copy those folders to ?

    I am reading about creating a Central Storage, could this be the issue?

    Thanks once more.


    Luis Olías.

    Thursday, December 01, 2016 12:45 PM
  • Ok, I am reading this:

    "...

    1. Double-click the .msi file, and then follow the instructions in the wizard to complete the installation. By default, the new ADMX files will be downloaded to the following directory on your local computer: C:\Program Files\Microsoft Group Policy\Windows Server 2008\PolicyDefinitions. Under the PolicyDefinitions directory, the new ADML files will be downloaded to the appropriate language-specific subdirectories for all languages for which this release is available.
    2. To ensure that the new ADMX and ADML files are propagated throughout the domain, on the computer on which you downloaded the new ADMX and ADML files, copy the new PolicyDefinitions directory to the appropriate location under SYSVOL on the appropriate domain controller. Doing so will ensure that all language-specific subdirectories are also copied to SYSVOL. 

      Important: Updates to SYSVOL are replicated to all domain controllers in the domain, which results in increased network traffic and load placed on the domain controllers. Therefore, to minimize the impact of this operation in your domain, we recommend that you schedule the copying of updated ADMX and ADML files to SYSVOL outside core business hours.

    ..."

    I already did this. Thanks!


    Luis Olías.

    Thursday, December 01, 2016 12:50 PM
  • Hi,

    I am checking how the issue going, if you still have any questions, please feel free to contact us.

    And if the replies as above are helpful, we would appreciate you to mark them as answers, and if you resolve it using your own solution, please share your experience and solution here. It will be greatly helpful to others who have the same question.

    Appreciate for your feedback.

    Best regards,

    Wendy


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Monday, December 05, 2016 6:52 AM
    Moderator
  • It worked out following this very simple steps (Sorry that I didn't post it before!) :

    https://kb.plesk.com/en/126687


    Luis Olías.

    Monday, December 05, 2016 8:11 AM
  • Hi,
    I am glad that it worked and thank you for sharing the update, we would appreciate you to mark the update as answer, as it will be greatly helpful to others who have the same question.
    Best regards,
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    Tuesday, December 06, 2016 1:58 AM
    Moderator