none
gpresult Access Denied

    Question

  • Hello, I am getting the dreaded ERROR:Access Denied when running gpresult on a Windows 7 SP1 32bit system. I ran winmgmt /verifyrepository and it came back Consistant. We are using an elevated command prompt, the user is a local admin, and UAC is disabled. When I use run as a different user, it runs fine for that user. When this user logs into another machine, he can run gpresult fine. From a remote machine running:

    gpresult /s PROBLEM-PC /user problemuserID /v

    also produces the error. Running

     gpresult /s PROBLEM-PC /user differentuserID /v

    throws INFO: The user "Test1" does not have any RSOP data, which is expected.

    Running rsop.msc works fine. This is only a big deal because we are doing an Intraforest migration (this user was migrated as part of the pilot) and we are worried that things may break during the migration.

    Thanks!

    Thursday, August 15, 2013 1:36 PM

Answers

  • Actually, I stopped the Windows Management Instrumentation manually (it had a third party dependency from Intel so I wonder if the winmgmt commands were not able to stop the service on their own) and then I ran Winmgmt /resetrepository as outlined in the link below, and then ran a gpupdate /force, and all was well. I suspect that the WMI ACLs are getting corrupted or not being translated by the ADMT as I was able to duplicate the problem and fix with several users and machines that I migrated today. I guess SIDHistory is not enough to save WMI. Thanks to everyone for their input!

    http://blogs.technet.com/b/askperf/archive/2009/04/13/wmi-rebuilding-the-wmi-repository.aspx

    Monday, August 19, 2013 6:23 PM

All replies

  • Could this be coming from a GP that the users has a deny security trimming?

    try to browse to sysvol folder of DC and see if you can see all the GPs and access them.

    Thursday, August 15, 2013 7:38 PM
  • Hi,

    Based on your description, you have disabled the UAC. Did you specify the user name and password information in the command? Any differences after running CMD as Administrator?

    Please also check firewall settings or disable firewall on the problematic PC to check the results.

    When you ran winmgmt /verifyrepository and find it came back Consistent. Did you log off and then log on to try the gpresult again? You can have a try and check if it could help.

    There is a similar question, please refer to.

    Cannot run gpresult Windows 7 - Error access denied

    http://social.technet.microsoft.com/Forums/en-US/dc0341c0-8c37-445e-ba65-c68a6ac43019/cannot-run-gpresult-windows-7-error-access-denied

    Hope this helps.

    Best regards,

    Justin Gu

    Monday, August 19, 2013 4:36 AM
    Moderator
  • Also try this,

    Run Gpresult by using a runas command, and then use the /user switch.
    Use the RSoP tools to verify the policies from a remote computer.


    Devaraj G | Technical solution architect

    Monday, August 19, 2013 10:56 AM
  • Actually, I stopped the Windows Management Instrumentation manually (it had a third party dependency from Intel so I wonder if the winmgmt commands were not able to stop the service on their own) and then I ran Winmgmt /resetrepository as outlined in the link below, and then ran a gpupdate /force, and all was well. I suspect that the WMI ACLs are getting corrupted or not being translated by the ADMT as I was able to duplicate the problem and fix with several users and machines that I migrated today. I guess SIDHistory is not enough to save WMI. Thanks to everyone for their input!

    http://blogs.technet.com/b/askperf/archive/2009/04/13/wmi-rebuilding-the-wmi-repository.aspx

    Monday, August 19, 2013 6:23 PM
  • This worked for me as well, on Windows 10 Pro Version 1607.  Thanks.
    Friday, February 3, 2017 3:27 PM
  • Thank you for this info.  Helped me on a similar issue.
    Thursday, July 27, 2017 8:27 PM