Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

So I've been trying to add a group policy to our servers for the last day or so.

After installing the GPMC and creating an new account with every group membership in the company when I right click on any group policy folder and click New I get a group policy message that says Access is denied.

Any ideas, suggestions?

share|improve this question
4  
My first suggestion is don't go messing with the SYSVOL folder. – Ben Pilbrow Aug 12 '11 at 21:53
Yeeeesh. By the power of Greyskull, why!? – Tom O'Connor Aug 12 '11 at 21:54
our last IT guy was ...special, he created a sysvol folder within the sysvol folder and that folder is shared. Problem? should I unshare that folder? – wyo9089 Aug 12 '11 at 21:55
1  
So you have a Windows\sysvol\sysvol\sysvol folder that's shared? If you're referring to there being a sysvol folder shared in the Windows\sysvol folder then that's as it should be. You can verify the sysvol and netlogon shares by following this article: technet.microsoft.com/en-us/library/cc816833(WS.10).aspx. – joeqwerty Aug 12 '11 at 22:10
yeah but gpmc cant see that folder – wyo9089 Aug 12 '11 at 22:21

1 Answer

up vote 1 down vote accepted

You generally see these errors when you have DFS replication issues on your domain controllers.

The first step would be to check your event logs (heck, that should always be your first stem) for FRS, and KCC error events.

Additionally I would run the dcdiag and netdiag tools on each DC in your environment to verify that everything is ok with your AD infrastructure.

OK so EDIT

AFTER you get your replication and any other issues worked out (clean Error logs, dcdiag and netdiag report no error. THEN you are going to need to go through and clean up the SYSVOL based on:

our last IT guy was ...special, he created a sysvol folder within the sysvol folder and that folder is shared. Problem? should I unshare that folder?

Get your replication issues sorted. Then you need to move that manual sysvol folder out of there and if it is sharing needed components, you need to recreate the share using a real file server.

share|improve this answer
Here's what failed with DCDiag, I'm not sure what exactly I'm looking at: Starting test: frsevent Error 5 opening FRS eventlog :File Replication Service: Access is denied. failed test frsevent Starting test: kccevent Error 5 opening FRS eventlog :Directory Service: Access is denied. Failed to enumerate event log records, error Access is denied. failed test kccevent Starting test: systemlog Error 5 opening FRS eventlog System: Access is denied. Failed to enumerate event log records, error Access is denied. failed test systemlog – wyo9089 Aug 12 '11 at 22:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.