Re: Delegating GPOs

From: Steven L Umbach (n9rou_at_n0-spam-for-me-comcast.net)
Date: 08/12/04 

Date: Thu, 12 Aug 2004 00:15:56 GMT

Check that they still have write permissions to the GPO itself in
GPO/properties/security. Check to see if a domain admin can edit and save the policy.
If an admin can then it must be a permission issue, possibly to that policy folder in
the sysvol share. You can find the policy number [unique name] in it's
roperties. -- Steve

"Mary Allio" <anonymous@discussions.microsoft.com> wrote in message
news:051301c47fdf$a05e5db0$3501280a@phx.gbl...
> I've delegated an OU with some other OUs contained with it
> to group A with all delegated rights.
>
> On the OUs there are GPOs assigned. I've assigned FC
> rights in AD Users and Computers on those GPOs to group A.
>
> Group A used to be able to edit the GPOs that I've
> assigned them FC rights to, but now they get an
> error "Failed to save failed to save
> ov\SysVol\Domain.gov\Policies\{18F0E4FA-C1A6-4565-BA82-
> 2C45E7CD7E5A}\Machine\Microsoft\Windows
> NT\SecEdit\GptTmpl.inf"
>
> I've re-delegated the OU and deleted and reassigned rights
> to Group A in AD Users and computers. The DCs seem to be
> running fine, no errors, and no synchronization problems.
>
> Any ideas what went wrong?

Relevant Pages

  • Re: Group Policy and Domain Type Problem
    ... We're having a problem on our Active Directory, we can not edit GPOs ... Default Domain Controllers Policy as well. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Question regarding Group Policy appling order
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... "Meinolf Weber" wrote: ... So your firewall is the first that applies, then domain policy. ... GPOs linked to the OU highest in the Active Directory hierarchy ...
    (microsoft.public.windows.server.active_directory)
  • Group Policy and Domain Type Problem
    ... Domain Controllers Policy as well. ... When we try to edit it, ... We can create new GPOs and edit them successfully, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Policy - Admin Locked Out
    ... I'm not sure at what level you created this gpo but you ... created the policy and then gp tab, lighlight the gpo, ... You can edit these rights here with the articles ... 267553 How to Reset User Rights in the Default Domain Controllers Group ...
    (microsoft.public.win2000.active_directory)
  • Re: New Group Policy Using Windows 2000 Snap-in
    ... When I created an edited from an upgraded> domain controller, at one point I received this error message when opening> Group Policy Management: The Enterprise Domain Controllers group must have> read access on all GPOs in the domain in order for Group Policy Modeling to> function properly. ... > tried to create and edit a GPO on this same domain controller I received the> same error message as in my original post. ... On the PDC and a DC that was a fresh install I was able to create and edit a GPO ...
    (microsoft.public.win2000.active_directory)
Loading