Can't Access GPO

[Eric Knorr]

I am unable to view or modify the GPO. I get an error
when I do the following on the Domain Controller:

Start>Program>Administrative Tool>Active Directory Users
and Computers. I select Domain Controllers>Right
Click>Properties>Group Policy Tab. I select 'Default
Domain Controllers Policy' and Edit. I get message box
coming up: GROUP POLICY ERROR - Failed to open the Group
Policy Object. You may not have appropriate rights.
Details: The system connot find the path specified.

So my question are:
What is the path suppose to be? What can I do to fix this?

Eric

 

[Tom Ausburne]

There are several things that could be causing this error. Rather
than writting a long email, take a look at this article and see if
anything helps. If not reply back.

253268 Group Policy Error Message When Appropriate Sysvol Contents
Are Missing
http://support.microsoft.com/?id=253268


Tom Ausburne (MSFT)
Windows 2000 Directory Services
This posting is provided "AS IS" with no warranties, and confers no
rights.

 

[Eric Knorr]

Thank you for the response, Tom.

In the article (http://support.microsoft.com/?id=253268)
says that 'This behavior can occur if any one of the the
following folder structures is missing:
%SystemRoot%\Sysvol\Sysvol\DomainName
%SystemRoot%\Sysvol\Sysvol\DomainName\Policies
%SystemRoot%\Sysvol\Sysvol\DomainName\Policies\{GUID}
%SystemRoot%\Sysvol\Sysvol\DomainName\Policies\{GUID}
\Machine
%SystemRoot%\Sysvol\Sysvol\DomainName\Policies\{GUID}\User'

The folder struture is present as seen in this <snip>.
The (GUID) numbers match the one listed in the Active
Directory Users and Computers Snap-in.

Is there a particular file that needs to be present?

Eric




<snip>
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies>dir /s
Volume in drive C has no label.
Volume Serial Number is 7850-47F4

Directory of C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies

09/22/2003 02:56p <DIR> .
09/22/2003 02:56p <DIR> ..
10/01/2003 10:18a <DIR> {31B2F340-016D-11D2-
945F-00C04FB984F9}
09/13/2003 11:58a <DIR> {6AC1786C-016F-11D2-
945F-00C04fB984F9}
09/22/2003 02:56p <DIR> {DACD384F-F316-4850-
9D0B-421B0C253CAE}
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}

10/01/2003 10:18a <DIR> .
10/01/2003 10:18a <DIR> ..
10/01/2003 10:18a <DIR> Adm
10/01/2003 10:38a 26 GPT.INI
10/01/2003 10:19a <DIR> MACHINE
10/01/2003 10:20a <DIR> USER
1 File(s) 26 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\Adm

10/01/2003 10:18a <DIR> .
10/01/2003 10:18a <DIR> ..
08/14/2002 02:00p 34,624 conf.adm
08/14/2002 02:00p 111,874 inetres.adm
06/19/2003 02:05p 753,702 system.adm
3 File(s) 900,200 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\MACHINE

10/01/2003 10:19a <DIR> .
10/01/2003 10:19a <DIR> ..
10/01/2003 10:19a <DIR> Applications
08/15/2002 02:08p <DIR> Microsoft
08/15/2002 02:16p 2,116 Registry.pol
10/01/2003 10:18a <DIR> Scripts
1 File(s) 2,116 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\MACHINE\Applications

10/01/2003 10:19a <DIR> .
10/01/2003 10:19a <DIR> ..
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft

08/15/2002 02:08p <DIR> .
08/15/2002 02:08p <DIR> ..
08/15/2002 02:08p <DIR> Windows NT
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows NT

08/15/2002 02:08p <DIR> .
08/15/2002 02:08p <DIR> ..
10/01/2003 10:38a <DIR> SecEdit
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\MACHINE\Microsoft\Windows
NT\SecEdit

10/01/2003 10:38a <DIR> .
10/01/2003 10:38a <DIR> ..
10/01/2003 10:38a 1,300 GptTmpl.inf
1 File(s) 1,300 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\MACHINE\Scripts

10/01/2003 10:18a <DIR> .
10/01/2003 10:18a <DIR> ..
10/01/2003 10:18a <DIR> Shutdown
10/01/2003 10:18a <DIR> Startup
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\MACHINE\Scripts\Shutdown

10/01/2003 10:18a <DIR> .
10/01/2003 10:18a <DIR> ..
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\MACHINE\Scripts\Startup

10/01/2003 10:18a <DIR> .
10/01/2003 10:18a <DIR> ..
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\USER

10/01/2003 10:20a <DIR> .
10/01/2003 10:20a <DIR> ..
10/01/2003 10:20a <DIR> Applications
08/15/2002 02:16p <DIR> Microsoft
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\USER\Applications

10/01/2003 10:20a <DIR> .
10/01/2003 10:20a <DIR> ..
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\USER\Microsoft

08/15/2002 02:16p <DIR> .
08/15/2002 02:16p <DIR> ..
08/15/2002 02:16p <DIR> RemoteInstall
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{31B2F340-
016D-11D2-945F-00C04FB984F9}\USER\Microsoft\RemoteInstall

08/15/2002 02:16p <DIR> .
08/15/2002 02:16p <DIR> ..
08/15/2002 02:16p 40 oscfilter.ini
1 File(s) 40 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{6AC1786C-
016F-11D2-945F-00C04fB984F9}

09/13/2003 11:58a <DIR> .
09/13/2003 11:58a <DIR> ..
10/16/2003 12:52p 23 GPT.INI
08/15/2002 02:08p <DIR> MACHINE
1 File(s) 23 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{6AC1786C-
016F-11D2-945F-00C04fB984F9}\MACHINE

08/15/2002 02:08p <DIR> .
08/15/2002 02:08p <DIR> ..
08/15/2002 02:08p <DIR> Microsoft
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{6AC1786C-
016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft

08/15/2002 02:08p <DIR> .
08/15/2002 02:08p <DIR> ..
08/15/2002 02:08p <DIR> Windows NT
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{6AC1786C-
016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT

08/15/2002 02:08p <DIR> .
08/15/2002 02:08p <DIR> ..
10/16/2003 12:52p <DIR> SecEdit
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{6AC1786C-
016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows
NT\SecEdit

10/16/2003 12:52p <DIR> .
10/16/2003 12:52p <DIR> ..
10/16/2003 12:52p 4,352 GptTmpl.inf
1 File(s) 4,352 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{DACD384F-
F316-4850-9D0B-421B0C253CAE}

09/22/2003 02:56p <DIR> .
09/22/2003 02:56p <DIR> ..
09/22/2003 02:56p 22 GPT.INI
09/22/2003 02:56p <DIR> Machine
09/22/2003 02:56p <DIR> User
1 File(s) 22 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{DACD384F-
F316-4850-9D0B-421B0C253CAE}\Machine

09/22/2003 02:56p <DIR> .
09/22/2003 02:56p <DIR> ..
0 File(s) 0 bytes

Directory of
C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies\{DACD384F-
F316-4850-9D0B-421B0C253CAE}\User

09/22/2003 02:56p <DIR> .
09/22/2003 02:56p <DIR> ..
0 File(s) 0 bytes

Total Files Listed:
10 File(s) 908,079 bytes
68 Dir(s) 46,752,511,488 bytes free

C:\WINNT\SYSVOL\sysvol\L3Devco.local\Policies>

 

[Tom Ausburne]

It appears that the two default policies, the Default Domain policy -
{31B2F340-016D-11D2-945F-00C04FB984F9}

and the Default Domain Controllers Policy -
{6AC1786C-016F-11D2-945F-00C04fB984F9}

are intact with the correct files in them.

Therer is a policy that is empty that should probably be deleted -
{DACD384F-F316-4850-9D0B-421B0C253CAE}

You should check and see what this was supposed to be for and then
delete it and the link to it and see if that solves your problem.


Tom Ausburne (MSFT)
Windows 2000 Directory Services
This posting is provided "AS IS" with no warranties, and confers no
rights.

 

[Guest]

Dear Mr. Ausburne,

I am having a very similar problem however according to the aforementioned knowledgebase article, in additin to your postings I find that My systems should be funtioning normally, however despite all my attempts, nothing seems to work and my application event log is over flowing with errors from Userenv and SecCli about how my group policy is not being enforced. In addition, when I try to do something as simple as reset a paasword for a user in the domain, I recieve an error stating that my password did not meet policy requirements and when I try to view the policy of course I get that same annoying "Path specified could not be found" message.

Thanx for anything
James

 

[Buz [MSFT]]

Are your clients getting Userenv and Scecli errors in the
application event log and if so what are the details of those errors? Are
the clients pointed to a Windows 2000 DC for DNS? Is DNS setup correctly?
Here is some stuff to get you started:

237675 Setting Up the Domain Name System for Active Directory
http://support.microsoft.com/?id=237675

823862 User Policies Are Not Applied When You Log On to a Computer That Is
http://support.microsoft.com/?id=823862

302104 The Logon Script Does Not Run During the Initial Logon Process
http://support.microsoft.com/?id=302104

227260 How a Slow Link Is Detected for Processing User Profiles and Group
Policy
http://support.microsoft.com/?id=227260

250842 Troubleshooting Group Policy Application Problems
http://support.microsoft.com/?id=250842

227369 Default Behavior for Group Policy Extensions with Slow Link
http://support.microsoft.com/?id=227369




If the above does not help enable Userenv logging on the client, log in
verify you did not get the policies, do whatever you have to do to make the
policies apply. Repost with that Userenv.log and the name of the user
account you are testing with. Also be more specific as far as what
configured policies are not applying and see if the clients are reporting
any Userenv errors in the application event log.

221833 How to Enable User Environment Debug Logging in Retail Builds of
Windows
http://support.microsoft.com/?id=221833

Buz Brodin
MCSE NT4 / Win2K
Microsoft Enterprise Domain Support

Get Secure! - www.microsoft.com/security

This posting is provided "as is" with no warranties and confers no rights.

Please do not send e-mail directly to this alias. This alias is for
newsgroup purposes only.

Dear Mr. Ausburne,

I am having a very similar problem however according to the

aforementioned knowledgebase article, in additin to your postings I find
that My systems should be funtioning normally, however despite all my
attempts, nothing seems to work and my application event log is over flowing
with errors from Userenv and SecCli about how my group policy is not being
enforced. In addition, when I try to do something as simple as reset a
paasword for a user in the domain, I recieve an error stating that my
password did not meet policy requirements and when I try to view the policy
of course I get that same annoying "Path specified could not be found"
message.