Deny Read to Default Domain Security Policy

[Guest]

Hi, I accidentally set "Deny Read" for Administrator to Default Domain
Security Policy. The group policy has been apply to all users and computers
in the domain except Administrator. The problem that I face now, I couldn't
change the policy setting because I couldn't access the GPO.
Is there a way how to "reset" the permission for GPO?
I deleted the Default Domain Security Policy object but it seems the policy
still apply to the domain. Where else the system store group policy setting?
Registry?
I appreciate some advice...

Thanks

 

[Herb Martin]

Hi, I accidentally set "Deny Read" for Administrator to Default Domain
Security Policy. The group policy has been apply to all users and computers
in the domain except Administrator. The problem that I face now, I couldn't
change the policy setting because I couldn't access the GPO.
Is there a way how to "reset" the permission for GPO?
I deleted the Default Domain Security Policy object but it seems the policy
still apply to the domain. Where else the system store group policy setting?
Registry?
I appreciate some advice...

If you are the owner or have full control (besides the deny
read) you should just go back to the MMC console you used
and set the Permissions to remove that denial.

IF you do not have full control, and somehow are not the
owner (maybe the "real" admin is the owner and you account
is "just another" admin) then you can either logon with the
correct account or take ownership.

Then the first paragraph applies.

The owner of an object can always reset permissions
on that object. The GUI might be giving your trouble if
it insists on reading the policy object (in some way) before
it shows you the permissions (but it should do that.)

If that is the case you will have to use a more direct tool
like ADSIedit.

AD permissions are very similar to NTFS permissions
with almost identifcal dialogs for permission and ownership
changes.

 

[Andrei Ungureanu]

also you might take a look here:
http://www.microsoft.com/resources/...erv/2003/standard/proddocs/en-us/dcgpofix.asp