Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have recently been made an Administrator on our server (running Win Server 2003) and have been given all the same permissions and made part of the same groups as our other admin but when I try to access the Group Policy Editor it tells me my access is denied because I don't have the appropriate permissions. I also cannot add or edit any users in the Active Directory. I go through the process and then when I finish it says "Error, Contact your System Administrator."

When I'm logged into the other admin's user account I can access the Group Policy Editor and create users in the Active Directory without problems. From his account I opened both our profiles in the active directory and confirmed that we are members of the same groups and have the exact same security permissions.

I went to the Group Policy Object in the Active Directory and it appear that the granular permissions are disabled so everyone in a particular group should have the same permissions right?

Also, I don't have a list of ALL the groups I'm a member of at the moment but I do know that I'm a member of the following groups: ENTERPRISE ADMINS, DOMAIN ADMINS, DOMAIN CONTROLLER ADMINS, SYSTEM ADMINS, SCHEMA ADMINS and the Local Administrators.

Why is my access being denied to anything? Where else should I be looking to diagnose this? How can I resolve this?

UPDATE: I tried doing all this directly from the server as well as by a remote connection to the server from one of the clients. Everything has been restarted several times since I was made an admin.

share|improve this question
Were you performing these tasks from your workstation or from a DC? If from your workstation, did you log off and back on after your group membership change? If from a DC, did you log on to the DC before or after your group membership change? – joeqwerty Jan 30 '12 at 23:15
Perhaps there's a Deny ACE somewhere for you or a group that you're in? The simplest to check might be editing users in AD - turn on Advanced Features in the View menu, then open the properties dialog on a user you can't edit. Security tab -> Advanced -> Effective Permissions tab, enter your user in there and see what it returns. – Shane Madden Jan 30 '12 at 23:16
@joeqwerty Why log off and back on when you can wait a week for a new ticket? ;) Definitely missed the part about it being new group memberships, that's got to be it. – Shane Madden Jan 30 '12 at 23:18
@ShaneMadden: in regards to a group ACE, as far as I can see in the Active Directory my account is setup exactly like the other admins and I am a member of the exact same groups as him, no more and no less, so if there was a deny ACE he'd be affect as well but he's not. I can't imagine that there are any entries specific to my account. I got hired in 2008 at which time the only admin didn't know how to do anything more than add a user and assign the user to groups. He wouldn't have known how to do anything beyond that when he made my account. – mattz Jan 30 '12 at 23:27
@joeqwerty: I've tried doing everything directly on the server as well as from a remote login from a client machine. Yes, I've been logged on and off several times. – mattz Jan 30 '12 at 23:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.