Access is Denied to W2k3 GPO's - Really stumped!

[CoreyWilson]

Hello all,

Problem: I receive an error when trying to open Group Policy via Group Policy Manager or from the default GPO editor since upgrading from Windows 2000 SP4 to Windows 2003 SP1 on my Domain Controllers.

Background: Since upgrading my two Windows 2000 SP4 DC servers to Windows 2003 with SP1 I cannot open to edit my gpo’s. On one server I installed the new GPO Manager, when I try and edit the default domain policy I receive this message under the settings tab of the administrative template of both computer and user configurations:

An unknown error occurred while data was gathered for this extension. Details: Access to the path "\\acsbackup01.acs2k\sysvol\acs2k\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\adm" is denied.

When I try and edit GPO’s through ADUC on the second win2k3 SP1 domain controller I get an access denied after being prompted to select the PDC Emulator server or the current selection server or any writable DC. I have tried all three. The event viewer is showing tons of 1030 and 1058’s. the 1058’s say the following:

Windows cannot access the file gpt.ini for GPO CN={6AC1786C-016F-11D2-945F-00C04fB984F9},CN=Policies,CN=System,DC=acs2k. The file must be present at the location <\\acs2k\sysvol\acs2k\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\gpt.ini>. (Access is denied. ). Group Policy processing aborted.

I followed the knowledge base articles windows help pointed to, I called and received the hotfix but it would not install stating my system is newer then the patch. Article reference:

http://support.microsoft.com/kb/842804/

Also, I physically applied an enterprise admin account to the sysvol folder as well as the policy folder stated above with FC permissions just to ensure somehow it wasn’t a permission problem that made no difference. Other things I have done is stop the DFS Server Service and tried the temp fix it suggested for purging DFS, made no difference either.

I would really appreciate if someone could help out here – as it stands I cannot access group policy on my domain controllers as I receive access is denied, it should be noted I am accessing with an enterprise admin account and a domain account these two accounts have always worked up to this point.

Thank you!

 

[tubbaguts]

you may have tried already but make sure that the account is a member of the "Group Polcy Creator Owner" group. You may also try removing SP1 and then the hotfix.

 

[markdmac]

I believe the fix for this is to correct an NTFS problem. Open the Windows directory. Right click on Sysvol. Choose Properties. Click the security tab. Click Add. Type Network Service Click OK. Select Full Control for the network Service. Click OK.

I hope you find this post helpful.

Regards,

Mark

 

[CoreyWilson]

Hi guys,

Thanks for the suggestions. Apparently the problem was SMB Signing that changed default permissions in the group policy after being upgraded to windows 2003. This following article details the issue and resolution: KB 839499. I was pointed to this article from microsoft's active directory newgroup.

Thanks again for the assistance. It should be noted that I tried the above recommendations first but unfortuntely in my case they did not resolve the prblem.