Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am simply trying to add GPO to an OU for WSUS. For some reason it is not applying the GPO when the users log in. There was a Websense GPO in there that i can not delete. It tells me the Server is Unwilling to Process the request. Could this be my issue and if so what do I do? Thanks for any help.

Thanks, Ryan

share|improve this question
Have you run gpresult to see if it is infact applied, but is failing for some reason? Have you looked at the event logs of the clients in question? Do you have a single DC or multiple? Is replication working properly? You need to provide a lot more detail if you want to get an answer. How to Ask is a good thing to read. – MDMarra Feb 13 '12 at 20:18
Aren't the majority of the WSUS settings related to a computer policy, and no the users? – Zoredache Feb 13 '12 at 20:43
hopefully this is a domain for about 5 users otherwise you might want to employ somebody that knows what they are doing. – tony roth Feb 14 '12 at 1:34

Odds are that you have multiple problems. I'm going to take a crack at one of them.

Edit the "Websense" GPO you mentioned in your question. In the Group Policy Editor, right-click the top node in the left pane of the window and choose "Properties". In the Properties Sheet that's displayed look at the "Unique Name:" value. I predict it will be "{31B2F340-016D-11D2-945F-00C04FB984F9}". (It might be "{6AC1786C-016F-11D2-945F-00C04FB984F9}", but that seems somewhat unlikely.)

If I was right about the GUID being the "{31..." identifier named above then you've got a "Default Domain Policy" object that you're calling the "Websense" GPO. Someone has likely renamed the "Default Domain Policy" and now you're trying to delete it. Active Directory is "unwilling" to allow you to delete that GPO because Microsoft designed it that way.

My advice is to return that GPO to "stock" settings, rename it back to "Default Domain Policy", see that it's linked only to the top level of the domain, and leave it alone.

You can use the DCGPOFIX.EXE utility (see to return the "Default Domain Policy" and "Default Domain Controllers Policy" back to their default settings. If you do decide to do that, be sure you save a copy of the settings report from the GPOs as they sit before you run DCGPOFIX so that you can create addt'l GPOs with your customizations in them.

In general, I highly recommend not making any modifications in these two default GPOs. If you don't modify them, and all else fails, you can always disable all your other GPOs and get "stock" behaviour for troubleshooting. (Can't say I've ever needed that, but it's nice to know it's there...) You can modify the default GPOs, but I recommend just creating addt'l GPOs with the customizations you need and assigning their priority appropriately.

Once you've gotten that in order I think we can begin to help you troubleshoot your GPO application problem. You'll need to provide a lot more detail in a question for us to help you with that, BTW. (Describe where the GPO containing the WSUS settings is linked in the domain, what the specific settings in the GPO are, where the computers are in the Directory relative to the GPO, the output of a gpresult /z command on a client where the GPO isn't applying as-expected, etc).

share|improve this answer
Totally agreed. The Default Domain Policy is there to contain... well... defaults. It's just scary how many would-be AD admins keep modifying that (or, much worse, the default DC one). – Massimo Feb 13 '12 at 21:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.