unable to open group polict object

hi,

i have 2 domain controllers-1 holds fsmo roles , other 1 backup. there problem backup , had re install windows , joined domain. in active directory, can create users/ou , replicate main dc(the 1 holds fsmo roles).

however, when go on group policy, error:

failed open group policy object. may not have appropriate rights. details: logon failure: targeted name incorrect

i have logged in on server administrative rights.c

an please help.

 

ps: can open group policy objects on other server holds fsmo roles.

 

hi,

i'd confirm there no multi-homed dc (that .. dc has multiple network interfaces installed).

please follow steps reset permissions:

1.start adsiedit.msc on pdc emulator.

note: determine pdc emulator operations masters role owner, right-click domain name in active directory users , computers snap-in, click operations masters, , click pdc tab.

2.under adsiedit, click domain nc, , locate following container:
domain_name container\cn=system\cn=policies container
right pane lists global universal identification numbers (guids) gpos in domain.

3.locate policy has been restricted, , note distinguished name of object, example:
cn={f5e14b83-0181-437e-878c-8d16cb945d68},cn=policies,cn=system,dc=jlc,dc=com
note: restricted policy displayed notepad icon; other policies displayed folder icons.

4.use dsacls remove deny access permissions have been assigned domain administrators group. use following syntax:
dsacls distinguished_name /r "domain_name\domain admins"
example:
dsacls cn={f5e14b83-0181-437e-878c-8d16cb945d68},cn=policies,cn=system,dc=jlc,dc=com /r "jlc\domain admins"

5.use dsacls /g switch grant access domain administrators group. use following syntax:
dsacls distinguished_name /g "domain_name\domain admins":ga

6.on pdc emulator, start microsoft windows explorer, , browse winnt\sysvol\sysvol\domain_name\policies folder. guid restricted gpo listed in folder.

7.right-click guid gpo, click properties, click security tab, , give domain administrators group full control permissions.

8.check subfolders under gpo object confirm domain administrators have rights these folders.
after complete procedure, if log on using domain administrator account, can open , edit gpo.
 
details:

"failed open group policy object" error message occurs when try open policy domain administrator
http://support.microsoft.com/kb/294257
hope helps!

best regards
elytis cheng

---

please remember click “mark answer” on post

elytis cheng

technet community support

Windows Server  >  Group Policy