One of our Users is not able to access one specific group policy folder (\DOMAIN\SysVol\DOMAIN\Policies\GUID\gpt.ini). Other users dont get any error message and can access the gpt.ini-file.

In the command line we receive this error while running gpupdate /force.

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"<System>
<Provider Name="Microsoft-Windows-GroupPolicy" Guid="{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}" />
<TimeCreated SystemTime="2017-12-14T07:07:16.970051600Z" />
<Correlation ActivityID="{C67B8903-7FBB-470B-B582-A062AE57F693}" />
<Execution ProcessID="1256" ThreadID="27824" />
<Security UserID="S-1-5-21-1953827594-2852325736-1325633896-3618" /></System><EventData>
<Data Name="SupportInfo1">4</Data>
<Data Name="SupportInfo2">912</Data>
<Data Name="ProcessingMode">0</Data>
<Data Name="ProcessingTimeInMilliseconds">2172</Data>
<Data Name="ErrorCode">5</Data>
<Data Name="ErrorDescription">Zugriff verweigert </Data>
<Data Name="GPOCNName">cn={106E1B5B-2366-4638-B62A-E650673E57C0},cn=policies,cn=system,DOMAIN</Data>
<Data Name="FilePath">\\DOMAIN\SysVol\DOMAIN\Policies\{106E1B5B-2366-4638-B62A-E650673E57C0}\gpt.ini</Data>

The Problem occures on every domain controller. I already tried all the solutions i found on the internet. The DFS-Services and the file replication are running, the networkconnection is obviously working. The permissions of the gpt.ini is looking good.

Permissions of the gpt.ini which brings up errors

DOMAIN\mapTNoDFS:(ID)(DENY)(special access:)


                                                                                        NT AUTHORITY\Authenticated Users:(ID)R 
                                                                                        NT AUTHORITY\SYSTEM:(ID)F 
                                                                                        DOMAIN\Enterprise Admins:(ID)F 
                                                                                        DOMAIN\Domain Admins:(ID)F 
                                                                                        NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS:(ID)R 

Any suggestions?

  • Have you trieds to remove the DENY flags (completely)? – bjoster Dec 14 '17 at 14:04
  • @bjoster Yes i tried that too, but the error still persists – Joshua Heisler Dec 15 '17 at 7:14
  • What does 'effective permissions' say? – bjoster Dec 18 '17 at 11:43

You couldn't access by UNC Path? Then make sure that DCs are pointing to itself as a preferred or alternative DNS server, and run ipconfig /flushdns, ipconfig /registerdns, restart netlogon service on each DC.

If you create a new user account for a test,same results?

Have you also follow the article to do a check


| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.