Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is a tough one in which I don't think anyone can find the answer for, not microsoft yet at least...

There is a Group Policy Object on the primary domain controller, and when I say primary, its got all 5 roles in ownership, and everytime I go to remove the old group policy I get a confirmation, and say 'yes' and than the server response with a window'

Group Policy Management

'The Server is unwilling to process the request.'

So my question is how do I go about removing this policy?

share|improve this question
    
Is this throwing anything into the eventviewer? If so, what? – GregD Jun 25 '09 at 21:24
    
Unfortunately nothing in ANY of the event logs reguarding this. The servers run very clean as any problems that had been seen in any of the event logs have always been delt with and or fixed no matter how benign. – Jason B Shrout Jun 25 '09 at 21:35
1  
I'm sure we can come up with an answer. I've seen the "unwilling" error in several instances with Active Directory. You're doing something that "breaks the rules", as it were. When you say "revemo the old group policy", what do you mean? You're unlinking a specific GPO? Deleting a GPO? Be a little more specific about what you're doing and we'll figure out what's going on. – Evan Anderson Jun 25 '09 at 22:07
    
When I say removing, I am performing a delete on the GPO. It is already unassociated with any users/workstations in any domain... Just can't delete it. – Jason B Shrout Jun 25 '09 at 22:59
1  
So, you're just using "Group Policy Management" console, and you've highlighted a GPO under the "Group Policy Objects" node beneath your domain and you're trying to right-click and "Delete" it? Out of curiosity, could you post the GUID from the GPO (can be gotten by opening the GPO to edit, right-clicking the top-level node in the group policy editor window, and highlighting the "Unique id" text). I have a thought... – Evan Anderson Jun 25 '09 at 23:16
up vote 5 down vote accepted

My psychic powers triumph again. >smile<

You're trying to delete the GPO "{6AC1786C-016F-11D2-945F-00C04fB984F9}". That GPO is the "Default Domain Controllers Policy". It might have been renamed, but that GUID is always assigned to that GPO during DCPROMO and never changes.

AD is "unwilling" to delete that GPO because Microsoft designed it that way.

My advice is to return that GPO to "stock" settings, rename it back to "Default Domain Controllers Policy", see that it's linked only to the "Domain Controllers" OU, and leave it alone.

You can use the DCGPOFIX.EXE utility (see http://technet.microsoft.com/en-us/library/cc736813(WS.10).aspx) to return the "Default Domain Policy" and "Default Domain Controllers Policy" back to their default settings. If you do decide to do that, be sure you save a copy of the settings report from the GPOs as they sit before you run DCGPOFIX so that you can create addt'l GPOs with your customizations in them.

In general, I highly recommend not making any modifications in these two default GPOs. If you don't modify them, and all else fails, you can always disable all your other GPOs and get "stock" behaviour for troubleshooting. (Can't say I've ever needed that, but it's nice to know it's there...) You can modify the default GPOs, but I recommend just creating addt'l GPOs with the customizations you need and assigning their priority appropriately.

share|improve this answer
    
Good stuff and you are right. After doing some research it is the default domain controller policy. Thanks! – Jason B Shrout Jun 26 '09 at 1:23
    
Very interesting! Evan, you are 'the one' – l0c0b0x Jun 26 '09 at 2:38
    
It's called "too much practice". smile I'm really getting into this Server Fault thing. I've never played an MMORPG, but I get the feeling that it kinda feels like this. – Evan Anderson Jun 26 '09 at 2:54

What probably happened is copied the default domain controller and then renamed the new one and then used it to create a policy then wanted to deleted it I have seen quit few people do this.

its actually poor design that server allows you to make policy in this manner form the original if it does not allow you to remove them also.

The Fix for the issue -

there is a way to delete ones you copied of the default domain GPO

go to the objects delegation - remove all the permissions - It should not let you do the permissions called system but you can try it did not allow me to do it for policy object.

then hit delete you will get error saying the object is not there or along those lines let system sit for while try it again, should get message saying it is not there, then hit refresh button.

the object should just magically vanish, from the list.

this worked for me many times when cleaning up copies

share|improve this answer
    
When you copy a policy, it inherits the permissions of the original policy, like copying a file or a policy that you create and change the permissions of. This isn't poor design, it's just a poor understanding of the behavior of the copy function. – austinian Jul 7 '15 at 14:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.