RE: Group Policy access denied

Hello Shawn,

Thank you for posting here.

From your post, I understand that after migrating the server from SBS 2000
to SBS 2003, GPO cannot be viewed in GPMC. Following error message is
received:

"Windows cannot find the network path. Verify that the network path is
correct and the destination computer is not busy or turned off. If Windows
still cannot find the network path, contact your network administrator"

Firstly I would like to confirm that how did you migrate the server? Did
you do that according to the white paper?

Migrating from Small Business Server 2000 or Windows 2000 Server to Windows
Small Business Server 2003
http://download.microsoft.com/download/6/d/c/6dccf9b4-d915-4c95-b5af-100b89e
02add/SBS_MigratingSBS2k.doc

If not, I suggest you re-do the migration by following the steps in the
white paper.

Thanks for your understanding.

If you migrated the server according to the white paper, let's try
following steps to see if we can resolve the problem:

Suggestion 1: Checking the binding order of the NICs:
=================================
1. Click Start, click Run, type ncpa.cpl , and then click OK.
2. On the Advanced menu, click Advanced Settings, and then click the
Adapters and Bindings tab.
3. Please ensure the Server Local Area Connection is at the top.

Suggestion 2: This issue can happen when "File and Printer Sharing for
Microsoft Networks" is not enabled on SBS internal NIC. To correct this:
============================================================================
==========
1. Open Network Connections.
2. Double click "Server Local Area Connection".
3. Click Properties.
4. Make sure that "File and Printer Sharing for Microsoft Networks" box is
checked.

Please also check it for the external NIC.

Suggestion 3: Check DNS settings:
======================
1. Right-click My Network Places, and then click Properties.
2. Right-click Local Area Connection, and then click Properties.
3. Click Internet Protocol (TCP/IP), and then click Properties.
4. Click Advanced, and then click the DNS tab. Configure the DNS
information as follows:

a. Configure the DNS server addresses to point to the internal NIC.
b. If the resolution of unqualified names setting is set to Append these
DNS suffixes (in order), the Active Directory DNS domain name should be
listed first (at the top of the list).
c. Verify that the DNS Suffix for this connection setting is the same as
the Active Directory domain name.
d. Verify that the Register this connection's addresses in DNS check box
is selected.

5. Click WINS tab, ensure WINS server is pointed to the internal NIC. Also
ensure enable NetBIOS over TCP/IP.

6. At a command prompt, type ipconfig /flushdns to purge the DNS resolver
cache, and then type ipconfig /registerdns to register the DNS resource
records.

Start the DNS Management console. There should be a host record (an "A"
record in Advanced view) for the computer name. There should also be a
Start of Authority (SOA in Advanced view) record pointing to the domain
controller (DC) as well as a Name Server record (NS in Advanced view).

After that, please check if the issue persists.

Suggestion 4: Check DNS server settings:
=========================
Microsoft recommends that the DNS Lookup zone accept dynamic updates. You
can configure this by right-clicking the name of the zone, and then
clicking Properties . On the General tab, the Allow Updates setting should
be set to Yes , or for an Active Directory-integrated zone, either Yes or
Only secure updates. If dynamic updates are not allowed, all host
registration must be completed manually.

I hope the above information is helpful to you. However, if the issue
persists, please help me gather following information:

1. Please help me capture screenshots of all error messages you encountered
and send them to v-mzhuan@xxxxxxxxxxxxx

To capture the image, we can perform the steps below:

(a) When the error message appears, press the Print Screen key several
times (this key is located to the right of the F12 key on the keyboard)
(b) Open Paint ['start' => 'All Programs' => 'Accessories' => 'Paint'].
(c) Click Edit (menu) -> Paste or press Ctrl + V.
(d) Click File (menu) -> Save. Save it as a .jpg or .gif file and send it
to me as an attachment.

2. Get GPresult on both the server and the client.
========
Reproduce the issue, type the following command in command prompt, and then
press ENTER:
"gpresult -Z > C:\gpresult_z.txt" (without the quotation marks)

This creates a list of the implemented policies on the machine in the
following text file: C:\gpresult_z.txt. Please send this file to me.

3. Please download the MPS Report tool from the following link and run it
on the SBS server, then send the generated CAB file to my mailbox
v-mzhuan@xxxxxxxxxxxxx for further investigation so that we can find what
the root cause is:

http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd9
15706/MPSRPT_DirSvc.EXE.

For your information:
http://www.microsoft.com/downloads/details.aspx?FamilyId=CEBF3C7C-7CA5-408F-
88B7-F9C79B7306C0&displaylang=en

Please try the above steps at your earliest convenience. If you have any
concern, please feel free to let me know.

Best regards,

Manfred Zhuang(MSFT)
Microsoft Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| NNTP-Posting-Date: Sun, 16 Sep 2007 11:15:07 -0500
| Date: Sun, 16 Sep 2007 17:14:57 +0100
| From: shawn c <shawn@xxxxxxxxx>
| User-Agent: Thunderbird 2.0.0.6 (Windows/20070728)
| MIME-Version: 1.0
| Newsgroups: microsoft.public.windows.server.sbs
| Subject: Group Policy access denied
| Content-Type: text/plain; charset=ISO-8859-1; format=flowed
| Content-Transfer-Encoding: 7bit
| Message-ID: <0aKdnfOVKM8Wy3DbnZ2dneKdnZydnZ2d@xxxxxx>
| Lines: 25
| X-Usenet-Provider: http://www.giganews.com
| NNTP-Posting-Host: 81.149.83.148
| X-AuthenticatedUsername: NoAuthUser
| X-Trace:
sv3-J6XEue03y/kaxauOuhwhDjWu00u2b3tZ6+tNpCSc4e77IrboIkebz4hB916UkG3QgpLsbgig
/H5NrJX!SiHkIr1f/JLKWqL6JsWKKYqoY9INR/Xyk87PD+xWImAbFkUs2jRjDdQDiuMDcSLZKtEA
fHJOOmw=
| X-Complaints-To: abuse@xxxxxxxxxxxxxx
| X-DMCA-Complaints-To: abuse@xxxxxxxxxxxxxx
| X-Abuse-and-DMCA-Info: Please be sure to forward a copy of ALL headers
| X-Abuse-and-DMCA-Info: Otherwise we will be unable to process your
complaint properly
| X-Postfilter: 1.3.35
| Path:
TK2MSFTNGHUB02.phx.gbl!TK2MSFTNGP01.phx.gbl!TK2MSFTFEEDS02.phx.gbl!newsfeed.
cw.net!cw.net!news-FFM2.ecrc.de!news.glorb.com!border1.nntp.dca.giganews.com
!nntp.giganews.com!local01.nntp.dca.giganews.com!nntp.bt.com!news.bt.com.POS
TED!not-for-mail
| Xref: TK2MSFTNGHUB02.phx.gbl microsoft.public.windows.server.sbs:63313
| X-Tomcat-NG: microsoft.public.windows.server.sbs
|
| hi
|
| We've just migrated our SBS from 2000 to 2003, most things seem to be
| working fine but just found out that the Group Policy isn't. When I
| tried to view policies in Group Policy Management console, a message box
| came up:
|
| "Windows cannot find the network path. Verify that the network path is
| correct and the destination computer is not busy or turned off. If
| Windows still cannot find the network path, contact your network
| administrator"
|
| I can browse the policy in
| \\{domainName}\SysVol\sm-ms.co.uk\Policies\{policy#}, but why can't the
| system?
|
| Events/errors (1030 & 1058) were logged being logged in event viewer.
| I've already tried kb834649, kb314494 and kb842804 but still doesn't
| solve the problem.
|
| I'd really appreciate it if experts here can point me to the right
| direction.
|
| Thanks
| Shawn
|

.

Relevant Pages

  • Re: NT Domain to AD migration
    ... Windows 2000/XP always prefer Kerberos authentication, ... Server 2003 Active Directory service, ensure that you have designed a DNS ...
    (microsoft.public.windows.server.active_directory)
  • Re: Secondary DNS and PIX
    ... Of course I updated them with the DNS ... WINDOWS SERVER 2003 FOR SMALL BUSINESS SERVER, ... Windows SBS 2003 SP1 is available. ...
    (microsoft.public.windows.server.sbs)
  • Re: Find AD hostname from Linux command line
    ... The Windows XP workstation gets an IP ... "Register this connection's addresses in DNS" turned ON. ... If I am on a Linux server and do "ping lancelot.ad.mydomain.com", ...
    (microsoft.public.win2000.dns)
  • Re: Secondary DNS and PIX
    ... SBS SP1 was a very specific service pack comprising several ... Root hints for DNS means you leave the forwarders ... WINDOWS SERVER 2003 FOR SMALL BUSINESS SERVER, ...
    (microsoft.public.windows.server.sbs)
  • Re: Two Win2k3 questions ... Roaming Profiles & Access Privileges ...
    ... >DHCP, DNS, Print Server, and File Server responsibilities. ... lookup zone on Windows NT" ... http://support.microsoft.com?kbid=229873 "Delegate Control Wizard Cannot Be Used ...
    (microsoft.public.win2000.advanced_server)