Re: access denied for administrator accounts

From: Vera Noest [MVP] (vera.noest_at_remove-this.hem.utfors.se)
Date: 11/30/04 

Date: Tue, 30 Nov 2004 13:15:54 -0800

"Raymond Norton" <admin@tamray.com> wrote on 30 nov 2004 in
microsoft.public.windows.terminal_services:

>
>> Do you get an "access denied" error immediately when you try to
>> start gpedit.msc, or when you try to actually change a policy
>> setting? Is the TS a member of an AD domain?
>> Which policy are you trying to edit? Are there any restrictions
>> in your AD on modifying policies? Maybe you need Enterprise
>> Administrator rights?
>
>
> Yes, I get an error message right away. "Group policy error, You
> do not have permission to perform this opperation"
>
> Details
> Access-denied
>
>
>
> This occurs when logging in as enterprise admin and local admin.

Sounds like you have a restrictive GPO in place, which is
affecting both normal users and Administrators.
Have you tried gpresult?

Another possibility is that you don't have Read access to SYSVOL
on your Domain Controllers. Some administrators remove Read access
to SYSVOL to prevent Administrators from being affected by
restrictive policies (which is not the recommended way to do
this).

816662 - Recommendations for Managing Group Policy Administrative
Template (.adm) files
http://support.microsoft.com/?kbid=816662

816100 - How To Prevent Domain Group Policies from Applying to
Administrator Accounts and Selected Users in Windows Server 2003
http://support.microsoft.com/?kbid=816100

 --
Vera Noest
MCSE, CCEA, Microsoft MVP - Terminal Server
http://hem.fyristorg.com/vera/IT
 --- please respond in newsgroup, NOT by private email ---

Relevant Pages

  • Re: Registry tatooing
    ... It can list and clean true policies, ... Speed Group Policy Troubleshooting with the NEW GPHealth Reporter tool at http://www.sdmsoftware.com/products.php ... Well, to his disliking, the settings remained. ...
    (microsoft.public.windows.server.active_directory)
  • Re: Group Policy question
    ... Policies" and Local Security Policy that is a subset of local Group Policy. ... the registry directly unless given direct and cohesive instructions ...
    (microsoft.public.windowsxp.security_admin)
  • RE: security policy not specified option
    ... Resultant Set of Policy does not in any way change the processing of Group ... processing different parts of group policy. ... Machine parses local policy and applies any settings contained in the ... parses computer configuration settings in those policies. ...
    (Focus-Microsoft)
  • Re: Multiple settings configured in one ou group policy
    ... The more policies that you have the more ... create a policy for every setting, as the more policies processed can have ... If you have policy settings that are going to change on a regular basis ... the group policy guide. ...
    (microsoft.public.windows.group_policy)
  • Re: Reset GP back to "out of box" ??
    ... for more info on the differences between policies and preferences) will get removed automatically if you unlink, deny permission to or disable the GPOs being applied to a given user or computer. ... However, security policy cannot be undone simply be removing the GPO that set it, as you've discovered. ... you should remove the settings in the domain GPOs that are causing the problems in the first place. ... Group Policy Management solutions at http://www.sdmsoftware.com ...
    (microsoft.public.windows.group_policy)
Loading