Cannot create new Group Policy Objects in Active Directory

[bkesting]

I have a Windows 2003 server running Active Directory. I have several Group Policy Objects created. Recently, I have tried to create a new GPO, but I get a simple message box that pops up and says "Access Denied" when trying to create one. I am trying to do this through the Group Policy Management Console. I am also trying this logged into the server locally as "administrator" and as a member of the Domain Admins group. Anyone have any past experiences of this happening and how to resolve this?

Thanks.

 

[jkupski]

If you're logged on as the local administrator (i.e. MACHINENAME\Adminstrator instead of DOMAIN\Administrator) then you, by definition, are not a member of the Domain Admins group.

 

[bkesting]

I am logged in as a DOMAIN/admin, what I meant by logged in locally is that I am actually physically at the server, not logged in remotely.

 

[ncotton]

Is this the same account as you had created the GPOs previously....

when you admin account do you mean domainname\Administrator (AKA Built In User), or have you created another account called Admin.

Can you access other currently existing GPO's? and chance the settings and "save/apply" them?

Do you get the access denied message on RightClick in the GPO container, on create new GPO, or on typing the name and pressing OK?

Let us know.

Hope this helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[Wishdiak]

bkesting,

Does the Event Viewer on the DC show any more information about the error?

Wishdiak
A+, Network+, Security+, MCSA: Security 2003

http://www.wishdiak.com

 

[Daveyd123]

I am having the same issues too. I can edit a GPO from another computer but not from the affected one. I am getting slammed by Events 1030 and 1050 in the Event Log of the problematic DC.

Here is my error message

http://img106.imageshack.us/img106/7581/error2sb.png

 

[bkesting]

It is the same account I've created the GPO's in before and it is the default Built In administrator account. Nothing out of the ordinary is showing up in the Event Viewer.

Here's the funny thing. On existing GPO's I can access them to edit them, but alot of the options under say Administrative Templates are missing, it is blank. I have a Windows 2000 server that is also a domain controller on this domain and thru that box I can apparantly create and edit GPOs there, just not on the Windows 2003 box. The only difference I can see off the top of my head between the two is that the Win 2K3 box is using the GPMC and the Win 2K box is not.

 

[ncotton]

o how you anaging the GPOs on the Win2k server?

Neil J Cotton
njc Information Systems
Systems Consultant

 

[bkesting]

Just through Active Directory Users & Computers