Access Denied to Imported GPOs
I have 2 seperate AD Domains I have backed up all GPOs from domain1 using the backupallgpos.wsf script file. I then imported all the GPOs into domain2 using the restoreallgpos.wsf script. This worked fine but there are a few changes I need to make. I am able to edit all settings in under Software Settings folder and Windows Settings folder for both computer and user configurations but I am unable to edit anything under the Administrative Templates on both Computer and User configuration. I get the error "The Group Policy snapin was unable to save your changes due to the following error: Access is denied"
I have checked the ACL on the ADM files in c:\windows\inf
I have checked the ACL on SYSVOL directories and below all the way down to the ADM files in the polices them self.
I am a Domain and Enterprise admin and I have full delegated access to the GPOs in question.
I can create a new GPO and add the ADM files successfully the new GPO is fully functional and I do not have a problem with newly created ones.
I have tried using the Copygpo.wsf script aswell to try creating a new GPO from a backed up gpo this has the same problem.
Can anyone help this problem has stumped a few peolple in the office.
Ashley Banks
Status:
Open Nov 21, 2007 - 12:18 AM
Errors, windows, information technology
5answers
Answers
Nov 21, 2007 - 09:58 AM
have you established a trust between your two domains? What happens is that GPO's have associated domain information attached and domain A won't let domain B's policies go into effect without a domain trust relationship. At the very least, if you've exported GPO's from domain A, then to import them to domain B, you need domain B to fully trust admins from domain A.
Use Active Directory Domains and Trusts to set up such a partnership.
Nov 26, 2007 - 12:21 AM
The 2 domains are not connected in anyway. All I wanted to achieve is to replicate the GPOs in one domain into another. The only way I see round this now is to import all the ADM files and just manually go through every setting in Domain A's GPOs and manually enter them into new GPOs I create on domain B.
Thanks for the response though.
Nov 26, 2007 - 08:06 AM
Determine the GUID of the GPO that you want to copy.
Create a new GPO in the target domain.
Determine the new GPO's GUID.
Navigate to the new GPO's storage area (%SystemRoot%\SYSVOL\sysvol\\Policies\{}), and delete the contents of that folder.
Copy the contents of the GPO folder from the original domain into the new GPO location.
For example, imagine I have an original GPO named Test in the savilltech.com domain and a GUID of 5AA140D1-397A-4B5C-B4DC-DF60FF731FC0. To copy this GPO to a new GPO named Sales in the domainB.com domain, I would perform the following steps:
Create a new GPO named Sales in the domainB.com domain.
Determine the new GPO's GUID (e.g., 600140D1-397A-4B5C-B4DC-DF60FF73XXXX).
Navigate to the new GPO's storage area (%SystemRoot%\SYSVOL\sysvol\domainB.com\Policies\{600140D1-397A-4B5C-B4DC-DF60F
F73XXXX}), and delete the contents of that folder.
Copy the contents of %SystemRoot%\SYSVOL\sysvol\domainA.com\Policies\{5AA140D1-397A-4B5C-B4DC-DF60FF
731FC0} to %SystemRoot%\SYSVOL\sysvol\domainB.com\Policies\{600140D1-397A-4B5C-B4DC-DF60FF
73XXXX}.
Be aware that you won't have both folders on one machine; instead, you'll be copying files between DCs.
Mar 04, 2009 - 06:01 AM
The question looks to be abandoned by the user who asked it. If no action is taken within 2 days, a Quomon Moderator will consider closing the question and distributing the points.
The Quomon Team
Answer this question
Share Your Own Experience & Expertise
We look to ensure that every question is answered by the best people with relevant expertise and experience, the best answers include multiple perspectives. Do you have relevant expertise or experience to contribute your answer to any of these commonly asked questions?
Add New Comment