We have got an Active Directory domain with Windows Server 2016 on the domain controller and up-to-date Windows 10 on all clients. Not long ago I began deploying the Center for Internet Security (CIS) Level-1 security benchmarks on the domain via the Group Policy: Windows 10 ones in the default domain policy, with overrides based on the Windows Server 2012 R2 document (there isn't one for 2016 yet) in the default controller policy. I've been bitten by careless hardening of Windows before so this time I've been going through all the settings one by one, with the relevant documents open and checking the impact of any unfamiliar options. It worked fine - until today, when I managed to finally mess something up. The symptoms are as follows

  1. Left-clicking on any GPO in Group Policy Management shows an "access denied" error box. I can still examine and manipulate object properties though, including changing the GPO status;
  2. Opening one of said GPOs for edition shows "access denied" again, albeit in a different box, and when the editor starts the visible tree entries are marked with a red X;
  3. Back in Group Policy Management, if I go to the Details tab of a GPO I can only see its AD version. The one in sysvol is described as not available;
  4. Finally, when I run gpupdate /force on any domain computer - including the DC itself - I get an error like this:

The processing of Group Policy failed. Windows attempted to read the file \contoso.com\sysvol\contoso.com\Policies{foo}\gpt.ini from a domain controller and was not successful. Group Policy settings may not be applied until this event is resolved. This issue may be transient and could be caused by one or more of the following: a) Name Resolution/Network Connectivity to the current domain controller. b) File Replication Service Latency (a file created on another domain controller has not replicated to the current domain controller). c) The Distributed File System (DFS) client has been disabled.

Unfortunately I've just realised I forgot to check the corresponding error code in the Event Log, however given that if I point Explorer to \contoso.com\sysvol\ (or for that matter any share on that server, using both the host and the domain name in the path) I get asked for credentials and have yet to find ones that work, my bet is on "access is denied" again. Accessing sysvol via the local path on the DC works fine, by the way.

In short, at least the latter two symptoms strongly suggest I have managed to lock myself out of the SYSVOL share; don't know if the former two are caused by this too or not. On a side note, after rebooting the domain controller to DSRM and then back to normal mode everything worked for around 10 minutes.

Now, I've got up-to-date backups so I could just restore to last working state and be done with it. However, what I would really like is to a) understand what settings exactly might have caused this problem (otherwise I'll likely run into the same issue again soon), and b) figure out how to make my domain work with all the hardening in place (CIS Level-1 benchmarks are baseline, they are not supposed to have much effect on functionality...). Oh, and c) if I can still actually do anything with the current configuration.

Anyone out there with experience with either hardening Windows in general or applying CIS benchmarks specifically, who could give me a nudge in the right direction? If so, thank you very much in advance!

Update: seems I was able to disable offending policies but it didn't undo the SYSVOL lockout. Resetting the local security policy to defaults with secedit hasn't helped either, possibly because of all the "access denied" warnings the procedure produced.

By the way, one interesting thing I noticed is that if I run "net share SYSVOL" on the DC from PowerShell prompt started with elevated permissions, it does return expected information (unlike running from a normal prompt which gives - you've guessed it! - "access is denied").

  • 1
    Primum non nocere - "First, do no harm". Which benchmark(s) specifically were you implementing/following?A best practice that's widely followed is to not make changes to the Default Domain policy (or the Default Domain Controllers policy) for this very reason. Create a new GPO and use that for your hardening. Without knowing exactly what you configured, it's practically impossible for us to advise you on which setting(s) locked you out.
    – joeqwerty
    Mar 10, 2017 at 22:57
  • 1
    If you're up for it, this is a process I created several years ago to deal with a situation very similar to yours. If you're game, give it a shot. If it doesn't work you'll be in no worse shape then you are now. - serverfault.com/questions/380459/…
    – joeqwerty
    Mar 10, 2017 at 23:00
  • I've got a complete list of settings I changed on the day the problem appeared, identified by their respective section numbers in the CIS benchmark documents.
    – Marecki
    Mar 13, 2017 at 8:48
  • Also, for future reference, how would I go about fixing this problem were my customisations in a non-default policy object? Maybe I've missed something here but I don't think it would actually help, given all I can do is disable and enable GPOs (and I can still do that on the default ones too)... Which has just given me an idea on how I might be able to fix this, stay tuned.
    – Marecki
    Mar 13, 2017 at 8:55

1 Answer 1


Okay, while I still do not know what caused the problem in the first place at least I have managed to fix it without reinstalling the system. Not sure which of the following steps were actually necessary but it has gone roughly like this:

  • dcgpofix /target:both (gave "access denied" errors on SYSVOL)
  • reboot to DSRM
  • secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose (gave a bunch of "access is denied" warnings but does reset at least User Rights Assignments and Security Options to default values)
  • reboot back to normal mode
  • dcgpofix /target:both again (finally fixed the problem)
  • restore last known good default GPOs from backup

Hope this will come in handy should anyone find themselves in the same predicament.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .