Re: Cant access Group policy

From: Eriq Neale (eon_at_eonconsulting.idonotwantspam.net)
Date: 01/06/05 

Date: Thu, 06 Jan 2005 13:41:29 GMT

On 2005-01-05 20:35:02 -0600, "=?Utf-8?B?VG9tbXk=?="
<Tommy@discussions.microsoft.com> said:

> I thought I did but maybe I didnt. I cant get in to tell you how I did
> it. But I think I might have change default domain policy and not the
> domain controller policy. Is there a way I can change that.

I've got to chime in on this here: You should never edit the Default
Domain Policy and Default Domain Controllers Policy. If you need to
modify settings that are controlled by those policies, create a new GPO
with the desired settings, have that GPO process before the Default
GPO, and enforce the settings in that GPO. For an example of doing
this, see the following link:
http://simultaneouspancakes.com/Lessons/archives/2004/12/how_to_disable.shtml
(Disabling SMB Signing on SBS 2003). Running DCGPOFIX on an SBS server
should be done ONLY as a LAST RESORT as it does a little more than just
resetting the Default GPOs back to their settings at initial
installation.

There are times when it's OK to make changes to items labelled
"Default" (i.e., the Default Recipient Policy in Exchange), but when it
comes to GPOs on SBS, never ever ever modify those GPOs. This is
exactly the kind of problem that can ensue.

Please review KB 833783 (http://support.microsoft.com/?id=833783)
before you run dcgpofix so you'll be aware of what is actually going to
happen if/when you run this.

-Eriq 

-- 
Eriq Neale - MCSE, MCSA Messaging, MCP Small/Medium Business, Mac Guru
EON Consulting
Need additional IT insight? E-mail "support at eonconsulting dot net"

Relevant Pages

  • Re: GPO - Access denied after changing a GP setting
    ... Domain controller: LDAP server signing requirements - None ... You are about to restore Default Domain policy and Default domain Controller po ... Unable to open the GPO due to access denied. ... You are about to restore Default Domain controller policy for the following domain ...
    (microsoft.public.windows.server.security)
  • Re: lost connections
    ... In the same GPO as mentioned. ... this setting is already zero. ... >> In Active Directory Users and Computers, ... Edit the default domain controller policy. ...
    (microsoft.public.windows.server.networking)
  • RE: Enabling Auditing for files and folders
    ... Default Domain Controller Policy GPO. ... This posting is provided "AS IS" with no warranties, ...
    (microsoft.public.windows.server.sbs)
  • Re: Cant access Group policy
    ... Do you know how to change the security setting for the gpo. ... >> domain controller policy. ... > modify settings that are controlled by those policies, ...
    (microsoft.public.windows.server.sbs)
  • Re: SBS R2 WSUS
    ... settings GPOs, or are "parts" in all three? ... Les Connor [SBS MVP] ... Does R2 combine the group policy settings for WSUS with other settings ... or does it have its' own GPO? ...
    (microsoft.public.windows.server.sbs)