Group Policy Object creating error

[panha_chea]

Hello

I have an AD for my domain. But when I create a Group Policy Object for an OU, I always get Access Denied error message even I log as administrator.

I am sure that I log as administrator. I can not find the solution.

You help is strongly appreciated

Thank you

[CrescendoBEAt]

hi

can u edit the default GPO for the domain controller? do u have permission for that? by the way check the Built-in security groups, maybe the administrator account has been removed from the "Administrator" and User accounts security groput.

[panha_chea]

I can edit the Default Group Policy for the domain but before I can do it displays many message as in the picture. I checked the security group Administrators my account is still the member of it. I just disable the policy "Password must meet the complexity" and rename "Administrator" built-in account to adminPtcComputer.

[valter]

Apply this hotfix for the string problem http://support.microsoft.com/default.aspx?...kb;en-us;842933

as per permissions, I think you need to restore default permissions to the gpo ... check the permissions on the default domain policy folder that starts with 6ac within your sysvol ...

[CrescendoBEAt]

oh i think u have a big problem in ur network!!!

as u know, troubleshooting the network problems like this are very complicated and actually there are many possible things that can cause these errors; u should think carefully; which setting u changed in other related services? do u have IIS and are change the settings in IE that can alert u for security pages?

by the way cause u change the administrator account name, may be this be problem. try to back it to Administrator {default] and then test for examin the problems; may be they solve.

by the way keep in mind that u shouldn't rename the administrator account after configuration of server critical services like IIS or other.

[panha_chea]

thank you Klasika and CrescendoBeat.

I can resolve the problem by http://support.microsoft.com/default.aspx?...kb;en-us;842933 but the Access Denied Error when I create group policy can not be solved.

I renamed the adminPtcComputer account back to "Administrator" and I have no IIS on my PDC.

I checked the permission of domain policy folder {6AC1786C-016F-11D2-945F-00C04fB984F9} in the sysvol, the Administrator account, Administrators group have full contorl permission.

The only thing I do on policy is configure the "Password must meet complexity" and "Minimum Password Length". I configure it back to undefined but it stay the same.

I have never install program on my PDC except the McAfee anti-virus.

[panha_chea]

I also have test another way.

First I promote one PC to be a domain controller (for new domain), and I go to Active Directory to create Group Policy Object for an OU, it works properly without any errors.

After that I remove Active Directory from that PC and I try to make it as BDC for my PDC. Now it is also get the error as the PDC. It get the Access Denied error too.

[CrescendoBEAt]

hi

this is the final steps that u can do, if these doesn't solved ur problem u should change the Windows Server.

Check the Security tab of the OU and check for any necessary configure;

then be sure that the admin account be the member of "Group Policy Creator Owners" and this group itself be a member of "Administrators" security group.

by the way for any question u can call Microsoft Support Center and they answer u; if u wanted the last option is this.

Phone NO. +1 800 936 4900

[valter]

That has something to do with permissions ... anyway, this tool works on Win2k (I haven't tried it on Win2k3), and should create default GPO on the server. Make sure you test it before you apply it ...

recreateDefPol.zip

[javier.toledo]

Hi all,

First at all, i want to apologize my very poor english.

The same problem make crazy for about a few days.

The problem is an Access Protection policy of the McAfee antivirus. (i recently installed versión 8.0 of VirusScan Enterprise)

You need to open Acces Protection Properties from de VirusScan console and uncheck the item "Prevent remote creation/modification/deletion of files in the Windows folder and subfolders (.ini)". Thats all.

I want that tip solve your problem.

Regards,

Javier Toledo

[chilifrei64]

Are you getting any specific errors in your event log?

Is your TCP/IP NetBIOS helper service running?