Cannot edit GPOs after 2003 upgrade

[yawnbob]

All my DC's have been upgraded from W2K to W2K3. Now when I try to edit group policy objects on *some* of my OU's I get an error and the GPO opens with a red x. None of the settings are viewable.

The error reads "Failed to open the Group Policy Object. You may not have appropriate rights. The system cannot find the path specified."

I've looked at permissions on the policy folder in \\domain\sysvol\domain\policies\{XXXX-XXXX...} and permissions on the security tab of the GPO properties and can't find any reason for this. This has occurred to maybe half of my 200+ GPO's. Most are pretty simple to re-create but that's the only way I've been able to solve the problem, delete and re-create.

I've used gpotool /checkacl and all policies came back okay. I'm doing all this while logged in as the domain admin. Ideas, anybody?

Bob

 

[yawnbob]

I was able to solve this problem with the Group Policy Management Console (GPMC) and figure out what the policy editor was looking for when it said it couldn't find a path. Using GPMC, I was able to view the GPO settings and backup my GPO's yet I still wasn't able to edit them. Since I was able to backup a GPO I then did a restore and now can edit them.

It turns out that when I restored the GPO it created a blank "User" folder that wasn't in the original policy data folder. My original folder only had an "Adm" and "Machine" folder.

Then I then took another policy that I couldn't edit, looked in the \\domain\sysvol\domain\policies\{XXXX-XXXX...} folder for a "User" folder. It wasn't there so I created one. That's all I needed to be able to edit it. So I wonder at what point these folders should have been created in my policies. Most of my policies are computer based so they wouldn't need a "User" folder.

Bob