5

It appears that our domain's default domain policy is corrupted. The GPT.ini file is corrupted. When I go to open it, I get an access denied error. I tried to take ownership through explorer, takeown, and CACLS with no luck. I also tried DCGPOFIX /target:Domain which froze when the process started. Any thoughts would be greatly appreciated. I have a backup of the GPO but of course when I try to restore it is locks up GPMC.

5
  • Do you have DFS replication errors in your logs?
    – Zypher
    Jun 18, 2011 at 20:32
  • The domain has a Windows 2003 server so it is using NTFRS. Neither the NTFRS or DFS logs come up with any issue.
    – JK2000
    Jun 18, 2011 at 20:39
  • We are having other GPO related issues; we cannot update them and the GPMC is constantly locking up. I was thinking of following KB315457 to rebuild the SYSVOL tree but I don't think I can proceed with this file locked.
    – JK2000
    Jun 18, 2011 at 21:29
  • Is it the default domain policy or a policy set as default?
    – Jim B
    Jun 19, 2011 at 1:58
  • This is the default domain policy. I wanted to remove everything to rebuild SYSVOL but I cannot delete or edit the Default Domain Policy's GPT.ini because I can't even take ownership of it. I removed the default domain policy from applying however the Windows XP computers are still trying to access it when they gpupdate and it causes the logons to wait until GP timeout which can be about 10 minutes.
    – JK2000
    Jun 19, 2011 at 19:14

3 Answers 3

1

From the comments, it sounds like you're going to have to boot a domain controller in Directory Services Restore Mode to be able to delete this file. If you've forgotten the password to do so, here's how to reset it.

1

Even with a corrupted security descriptor, takeown or GUI should allow you to re-claim onwership then permissions. I would suspected file system or disk corruption if it's only on one DC. But since you see access denied on all DCs, please check if you are indeed using domain admin credential - I know it sounds very basic and you might feel offended - but that's the only other thing I can think of. A corrupt security descriptor or file lock doesn't get replicated cross machines.

1
  • Yeah that's not a bad thought, it would explain some of the "I can't do xxx" issues
    – Jim B
    Oct 30, 2015 at 18:33
0

DCPGofix is supposed to reset group policy to its default state. If it fails you may have something else wrong in active directory. Look for additional errors in the event log. You might also try running it on other DCs to see if the issue has replicated.

7
  • unfortunately the issue has replicated to all other DCs, on each DC the gpt.ini for the Default Domain Policy is inaccessible on the file system level. I can't edit permissions or take control and any file operation I try on it I get an access denied. I believe this file is the reason DCGPOFIX is locking up when running. I gave it 15 minutes or so but in a VM I tested it should've worked immediately.
    – JK2000
    Jun 19, 2011 at 19:32
  • try deleting the policies directory of sysvol and rerun dcpgpofix
    – Jim B
    Jun 19, 2011 at 19:40
  • I am hoping to do that, but I am unable to delete the policy due to the corruption of gpt.ini anytime I try to delete that folder I get an access denied on gpt.ini. I am having trouble finding a way to remove that file since I can't take ownership or even view permissions on it, everything I do I get access denied even with NTFRS stopped.
    – JK2000
    Jun 20, 2011 at 0:53
  • the whole folder won't delete? try stopping the frs service on the DC and try again. You may need to remove the guids in adsiedit You can also (as a dead last resort try following kb315457 support.microsoft.com/kb/315457. if that is the case you might want to engage microsoft either on answers.microsoft.com or with a support call.
    – Jim B
    Jun 20, 2011 at 1:50
  • I am looking to follow KB315457 but the GPT.ini file will not delete. If I try to delete, rename, move, open, etc, it says access denied. For some reason I can't take ownership of the file or set an ACL. Everything I try to do with the file results in access denied so I can't remove the GPO.
    – JK2000
    Jun 20, 2011 at 2:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .