We inherited a network with badly damaged GPOs across 3 DC's (all WinServ 2016). We receive an "Access Denied" error when using GPOs, and the permissions of the SYSVOL folder show signs of tampering. I have attempted a D2 and D4 restore, following these instructions: https://docs.microsoft.com/en-US/troubleshoot/windows-server/group-policy/force-authoritative-non-authoritative-synchronization

However the issue persists.

The thing is, there are no group policies present other than the default 2. So what I would really like to do is reset the entire GPO system to default, rebuild the SYSVOL folder entirely from scratch to receive default permissions, and then perform another D4 authoritative sync. Is this possible? How can it be done?


1 Answer 1


That's quite a broad question. Recreating SYSVOL is not just one simple step. Here is the documentation for this whole process: https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/rebuild-sysvol-tree-and-content-in-a-domain

Resetting the default domain policies is much easier. Use the dcgpofix tool:

dcgpofix /ignoreschema /target:both
  • Upon running this I receive an error: Unable to create the file or directory C:\Windows\SYSVOL\domain.site\Policies. The system cannot find the path specified. I can confirm that a junction exists at c:\windows\sysvol\domain.site which points to c:\windows\sysvol\domain\ Commented Apr 22, 2022 at 18:40
  • I'll proceed with the link to rebuild SYSVOL and report back here. Commented Apr 22, 2022 at 18:52
  • ultimately this answers my question to rebuild sysvol even if the access denied error persists. Commented Apr 22, 2022 at 21:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .