Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This is a tough one in which I don't think anyone can find the answer for, not microsoft yet at least...

There is a Group Policy Object on the primary domain controller, and when I say primary, its got all 5 roles in ownership, and everytime I go to remove the old group policy I get a confirmation, and say 'yes' and than the server response with a window'

Group Policy Management

'The Server is unwilling to process the request.'

So my question is how do I go about removing this policy?

share|improve this question
    
Is this throwing anything into the eventviewer? If so, what? –  GregD Jun 25 '09 at 21:24
    
Unfortunately nothing in ANY of the event logs reguarding this. The servers run very clean as any problems that had been seen in any of the event logs have always been delt with and or fixed no matter how benign. –  Jason B Shrout Jun 25 '09 at 21:35
1  
I'm sure we can come up with an answer. I've seen the "unwilling" error in several instances with Active Directory. You're doing something that "breaks the rules", as it were. When you say "revemo the old group policy", what do you mean? You're unlinking a specific GPO? Deleting a GPO? Be a little more specific about what you're doing and we'll figure out what's going on. –  Evan Anderson Jun 25 '09 at 22:07
    
When I say removing, I am performing a delete on the GPO. It is already unassociated with any users/workstations in any domain... Just can't delete it. –  Jason B Shrout Jun 25 '09 at 22:59
1  
So, you're just using "Group Policy Management" console, and you've highlighted a GPO under the "Group Policy Objects" node beneath your domain and you're trying to right-click and "Delete" it? Out of curiosity, could you post the GUID from the GPO (can be gotten by opening the GPO to edit, right-clicking the top-level node in the group policy editor window, and highlighting the "Unique id" text). I have a thought... –  Evan Anderson Jun 25 '09 at 23:16
show 1 more comment

1 Answer

up vote 4 down vote accepted

My psychic powers triumph again. >smile<

You're trying to delete the GPO "{6AC1786C-016F-11D2-945F-00C04fB984F9}". That GPO is the "Default Domain Controllers Policy". It might have been renamed, but that GUID is always assigned to that GPO during DCPROMO and never changes.

AD is "unwilling" to delete that GPO because Microsoft designed it that way.

My advice is to return that GPO to "stock" settings, rename it back to "Default Domain Controllers Policy", see that it's linked only to the "Domain Controllers" OU, and leave it alone.

You can use the DCGPOFIX.EXE utility (see http://technet.microsoft.com/en-us/library/cc736813(WS.10).aspx) to return the "Default Domain Policy" and "Default Domain Controllers Policy" back to their default settings. If you do decide to do that, be sure you save a copy of the settings report from the GPOs as they sit before you run DCGPOFIX so that you can create addt'l GPOs with your customizations in them.

In general, I highly recommend not making any modifications in these two default GPOs. If you don't modify them, and all else fails, you can always disable all your other GPOs and get "stock" behaviour for troubleshooting. (Can't say I've ever needed that, but it's nice to know it's there...) You can modify the default GPOs, but I recommend just creating addt'l GPOs with the customizations you need and assigning their priority appropriately.

share|improve this answer
    
Good stuff and you are right. After doing some research it is the default domain controller policy. Thanks! –  Jason B Shrout Jun 26 '09 at 1:23
    
Very interesting! Evan, you are 'the one' –  l0c0b0x Jun 26 '09 at 2:38
    
It's called "too much practice". smile I'm really getting into this Server Fault thing. I've never played an MMORPG, but I get the feeling that it kinda feels like this. –  Evan Anderson Jun 26 '09 at 2:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.