[ActiveDir] GPMC error with settings tab
For some strange reason when I use the GPMC, highlight a policy and select the settings tab I get an "unspecified error" and the policy settings do not display on the right side. Anyone aware of anything causing this problem. I installed the 2003 SP1 GPMC when it came out. Please help.I have to fix my Default Domain Controller policy because it has waayyy too many defined settings for files and registry keys. The main reason is that some things like License Logging Service will not work on any DC's and it is a permissions problem with the "network service" account. Sometimes I wish they never came up with this account as I have had to "fix" some security settings in the past to get some services to work correctly. Thanks William Krenceski Network Administrator [EMAIL PROTECTED] Confidentiality Notice: The information contained in this message may be legally privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any release, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error please notify the author immediately by replying to this message and deleting the original message. Thank you.
RE: [ActiveDir] GPMC error with settings tab
Never mind...I just re-installed GPMC (with sp1) and it works now.. From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Krenceski, WilliamSent: Wednesday, May 17, 2006 9:18 AMTo: ActiveDir@mail.activedir.orgSubject: [ActiveDir] GPMC error with settings tab For some strange reason when I use the GPMC, highlight a policy and select the settings tab I get an "unspecified error" and the policy settings do not display on the right side. Anyone aware of anything causing this problem. I installed the 2003 SP1 GPMC when it came out. Please help.I have to fix my Default Domain Controller policy because it has waayyy too many defined settings for files and registry keys. The main reason is that some things like License Logging Service will not work on any DC's and it is a permissions problem with the "network service" account. Sometimes I wish they never came up with this account as I have had to "fix" some security settings in the past to get some services to work correctly. Thanks William Krenceski Network Administrator [EMAIL PROTECTED] Confidentiality Notice: The information contained in this message may be legally privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any release, dissemination, distribution, or copying of this communication is strictly prohibited. If you have received this communication in error please notify the author immediately by replying to this message and deleting the original message. Thank you.
Re: [ActiveDir] GPMC Error
Thanks Darren Matty, I'm going to try your suggestions out and I'll let you know how it turns out. Darren I just picked up the resource kit. Your group policy book is great. Excellent work!! Thanks Mike On 7/10/05, Darren Mar-Elia [EMAIL PROTECTED] wrote: That's part of it. That doesn't control whether Domain Admins can create GPOs in the first place. It just controls the ACLs a new GPO object gets when its created. You have to also modify the permissions on the System\Policies container in the domain and the permissions on the Policies folder in Sysvol. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Holland Sent: Sunday, July 10, 2005 2:45 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] GPMC Error Hi Mike, This article should help you out. http://support.microsoft.com/kb/321476/EN-US/ Cheers, Matty On 09/07/05, mike kline [EMAIL PROTECTED] wrote: I would like to delegate GPO creation to a handful of people. I open GPMC and then go to group policy objects. I select the delegation tab and try to remove the domain admins. I receive an error -- The Request is not Supported Is my only option to go into the ACL on the domain using ADUC and strip their rights that way. I realize that a lot of people on this board are going to ask why are these people domain admins? If you don't trust them to create a GPO then they probably shouldn't be a DA. I agree with those that share that sentiment but I have given up on that fight at this point. Sometimes the people the sign the checks win. Thanks Mike List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
Re: [ActiveDir] GPMC Error
Hi Mike, This article should help you out. http://support.microsoft.com/kb/321476/EN-US/ Cheers, Matty On 09/07/05, mike kline [EMAIL PROTECTED] wrote: I would like to delegate GPO creation to a handful of people. I open GPMC and then go to group policy objects. I select the delegation tab and try to remove the domain admins. I receive an error -- The Request is not Supported Is my only option to go into the ACL on the domain using ADUC and strip their rights that way. I realize that a lot of people on this board are going to ask why are these people domain admins? If you don't trust them to create a GPO then they probably shouldn't be a DA. I agree with those that share that sentiment but I have given up on that fight at this point. Sometimes the people the sign the checks win. Thanks Mike List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
RE: [ActiveDir] GPMC Error
That's part of it. That doesn't control whether Domain Admins can create GPOs in the first place. It just controls the ACLs a new GPO object gets when its created. You have to also modify the permissions on the System\Policies container in the domain and the permissions on the Policies folder in Sysvol. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Matt Holland Sent: Sunday, July 10, 2005 2:45 PM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] GPMC Error Hi Mike, This article should help you out. http://support.microsoft.com/kb/321476/EN-US/ Cheers, Matty On 09/07/05, mike kline [EMAIL PROTECTED] wrote: I would like to delegate GPO creation to a handful of people. I open GPMC and then go to group policy objects. I select the delegation tab and try to remove the domain admins. I receive an error -- The Request is not Supported Is my only option to go into the ACL on the domain using ADUC and strip their rights that way. I realize that a lot of people on this board are going to ask why are these people domain admins? If you don't trust them to create a GPO then they probably shouldn't be a DA. I agree with those that share that sentiment but I have given up on that fight at this point. Sometimes the people the sign the checks win. Thanks Mike List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
[ActiveDir] GPMC Error
I would like to delegate GPO creation to a handful of people. I open GPMC and then go to group policy objects. I select the delegation tab and try to remove the domain admins. I receive an error -- The Request is not Supported Is my only option to go into the ACL on the domain using ADUC and strip their rights that way. I realize that a lot of people on this board are going to ask why are these people domain admins? If you don't trust them to create a GPO then they probably shouldn't be a DA. I agree with those that share that sentiment but I have given up on that fight at this point. Sometimes the people the sign the checks win. Thanks Mike List info : http://www.activedir.org/List.aspx List FAQ: http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
