none
Domain Administrator unable edit GPO RRS feed

  • שאלה

  • I am running a 2016 domain The I am unable to edit GPOs.  Just a few weeks ago I was able to edit them with no problems. No I get the following error

    This is happening will all of my GPOs not just one.  I can navigate to the Windows\SYSVOL\domain\Policies folder and open any of the GPO folder with no problem.

    I have fixed this problem once by changing permissions of the Sysvol folder to full control for the domain administrator.  That fixed the problem.  Now the problem is back and the permission for the Sysvol folder are still set to full control for the domain administrator.  I tried it directly from the server and using the remote admin tools.  The only GPO that I can edit is the default Domain.  I have 12 different GPOs set up for different things.

    יום שני 01 יולי 2019 16:42

כל התגובות

  • Hi,
    >>I can navigate to the Windows\SYSVOL\domain\Policies folder and open any of the GPO folder with no problem.

    Based on the error information, I suppose that you may can not access SYSVOL folder via UNC path.
    For further troubleshoot, please try to access SYSVOL folder via UNC path \\domain\sysvol instead of Windows\SYSVOL\domain\Policies.

    If we can not access the folder, or we can access SYSVOL folder but GPT folders(named as GUID) are missing, we should check firewall configuration, shared folders and SYSVOL replication between DCs.



    Best Regards,
    Daisy Zhou

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    יום שלישי 02 יולי 2019 07:18
    מנחה דיון
  • I just tried using the \\domain\sysvol and I was able to see all file even the policies.  I was also able to access the different policy folders.

    The Windows firewalls are turned off and as far as I can tell replication is working.

    יום שלישי 02 יולי 2019 12:18
  • I just discover today that some of the GPOs are not working on all computers.  All computers are running the same version of windows 10.
    יום שלישי 02 יולי 2019 16:08
  • I just discover today that some of the GPOs are not working on all computers.  All computers are running the same version of windows 10.

    Hi,

    Can we access SYSVOL folder from the clients? Please collect Group Policy result to see if there has some error information logged.

    In addition, can you edit those GPOs now? Please clarify the current situation so we can provide more pertinent suggestion and solution for you.


    Best Regards,
    Daisy Zhou


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    יום רביעי 03 יולי 2019 13:58
    מנחה דיון
  • Hi,
    If this question has any update or is this issue solved? Also, for the question, is there any other assistance we could provide?

    Best Regards,
    Daisy Zhou

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    יום שישי 05 יולי 2019 02:44
    מנחה דיון
  • Hi,
    I am just writing to see if this question has any update. If anything is unclear, please feel free to let us know.
    Thanks for your time and have a nice day!


    Best Regards,
    Daisy Zhou

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    יום שני 08 יולי 2019 07:54
    מנחה דיון
  • Sorry I have been out on holiday for the past 4 days.

    Sysvol can be accessed by client computers.

    I am still unable to edit GPOs

    יום שני 08 יולי 2019 12:18
  • Hi,
    You are welcome.

    In order to narrow down the issue, would you mind confirming the following information:

    1. How many GPOs you can not edit?
    2. Which error information displayed? Still is "The system cannot find the path specified"?
    3. How many DCs in your environment?
    4. Open GPT folder (C\windows\SYSVOL\domain\Policies\{GUID}) on at least two DCs about one of issue GPO, compare time stamp and version information.
    5. If there has some error information displayed when running dcdiag /v?



    Best Regards,
    Daisy Zhou

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    יום רביעי 10 יולי 2019 02:37
    מנחה דיון
  • 1. I have 12 GPOs plus the Default domain GPO.  The only one I can edit is the Default Domain  .

    2. The error is listed in the first post.

    3. I have 2 DCs

    4. they match

    5. no errors when running dcdiag /v

    יום רביעי 10 יולי 2019 12:11
  • Hi,
    Please check logged events via event viewer, find out which folder cannot be accessed, then native to the folder and verify permission setting, make sure the permission setting is similar as the screenshot below:










    Best Regards,
    Daisy Zhou



    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    יום חמישי 11 יולי 2019 08:57
    מנחה דיון
  • As I stated earlier I have already done that.  I have set the permission for all if the different polices folder to full control for the domain administrator.  It work when I fist did it but then it stopped working.  I have checked and they are still set to full control.

    יום חמישי 11 יולי 2019 12:28
  • Hi,
    Thanks for your update.

    I'm sorry that I can not find other possible reason about the issue.

    If we can create and edit a new GPO, I will suggest you try the following steps, if the steps not working, I will suggest you submit a service request with Microsoft to get more efficient support.

    Steps for your reference:

    1. Backup GPO settings to local folder.


    2. Create a new GPO, then import settings from backup file.


    3. Verify new GPO settings and apply the GPO to domain.




    Best Regards,
    Daisy Zhou

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    יום שני 15 יולי 2019 10:20
    מנחה דיון
  • Hi,
    Would you please tell me how things are going on your side. If you have any questions or concerns about the information I provided, please don't hesitate to let us know.
     
    Again thanks for your time and have a nice day!



    Best Regards,
    Daisy Zhou

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    יום רביעי 17 יולי 2019 08:35
    מנחה דיון
  • I have to contact MS support because nothing was working. They only made things worse by deleting my GPOs and doing something to the backup domain controller making it unable to boot.  I ended up having to reload the domain controller and rebuild all the GPOs.  Thanks for the help everybody.
    יום רביעי 17 יולי 2019 12:24
  • Hi,
    Thank you for your update. I am so sad to hear that. I hope everything will be fine in the future.

    Have a nice day!



    Best Regards,
    Daisy Zhou


    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    יום חמישי 18 יולי 2019 09:46
    מנחה דיון