Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Windows 2K8R2 domain.

I created a GPO to restrict Domain User access to certain server components on an RDS Host. Now I cannot access the functions I restricted. I am a member of both the Domain Users and Domain Admins account.

How can I change the GPO object when I cannot access the mmc?

Thank you.

share|improve this question

If you can't launch the MMC because of restrictions (Did you apply this GPO to the whole domain or something?!) then you can use PowerShell's Group Policy module.

Log in as a Domain Admin and launch PowerShell on a computer with the AD Commandline Tools from RSAT installed . Run:

Import-Module GroupPolicy

Remove-GPLink -Name "GPO That Breaks Everything" -Target "ou=OU Where It Is Linked,dc=contoso,dc=com"

This will remove the link to the GPO without destroying the whole GPO.

If you want to just remove the whole GPO all together, then you can run:

Import-Module GroupPolicy

Remove-GPO -Name "GPO That Breaks Everything"
share|improve this answer
up vote 0 down vote accepted

I resolved this by changing the permissions for the admin group, under the respective GPO, to 'Deny' under Apply Group Policy.

share|improve this answer

If you are also member of Domain Users and you denyed access to mmc for Domain Users, you wont be able to use it. Thats how permissions work - deny permission is stronger than allow permission. If you deny access for some group, every user which is also in that group has denied access, even if he has allow permissions from other groups.

The easiest solution would be to login as a user not in Domain Users group and with admin privileges ( for ex. local Administrator on domain controller) and revert changes in gpo back.

Other solutions would be based on what exactly did you denyed...

share|improve this answer
There are no local administrators (or any local accounts for that matter) on Domain Controllers except in the case of RODCs, but that user wouldn't be able to modify GPO if it were an RODC. – MDMarra Mar 15 '13 at 1:32
you are right. sorry, I didnt express myself properly. I didnt mean LOCAL Administrator, but the Administrator account that exists in a domain. But i didnt realized, that it is also member of Domain Users... – betatester07 Mar 15 '13 at 7:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.