GPMC Help !!!!!

[John]

I apologise for making a nearly identical post again but,
I am at my wits end.....

I have been successfuly importing settings into GPOs using
GPMC for about a month. The imports were tested on two
test networks using migration tables to do domain specific
bits. (Some security groups and users common to all
forests)

Last week two of our sites (forests) were upgraded to
W2K/AD servers. Their GPO settings were imported using
GPMC and an XP SP1 laptop with the original backed up GPOs
and migration tables created with a vb script. (This has
worked OK up until now.)

There are a couple of settings in the Default Domain
Policy that need to be set manually.. (Primary DNS Suffix
and Browser Title) and now...

Access Denied errors.. Can't edit the Default Domain or
Default Domain Controllers Policy... All permissions check
out, or at least seem OK. (Even creating a new user with
full permissions and explicitly granting them full control
in AD and sysvol doesn't work.) Policies applied to OUs
are OK.

I have 'fixed' the two 'broken' sites by... Deleting the
appropriate folders from sysvol and creating new Domain
and DC policies and doing the settings by hand.

I have some 280 sites to go.. only 12 GPOs but, the
potential for mistakes doing them manually is, frankly,
scary...

Am I missing something obvious........... ???

Please let me be missing something obvious....

 

[Ullattil Shaji[MSFT]]

Can you give us some details like
1. Are there multiple DCs in the domain?
2. Where is the backup? Is it on a CD by any chance?
3. What was the error message that you got when you were trying to edit the
policy?
4. Which files did you have to delete to fix the problem?

Thanks,
-Shaji

 

[John]

Hi Shaji thanks for your response.

In answer to your questions:-

1. Only one DC in the domain.

2. The backup is on a laptop. (All the backed up policies
have their read only attribute set to avoid inadvertant
changes.)

3. No error message when editing the policies via
ADUC. 'Can't save changes. Access denied' when using GPMC.

4. I deleted the whole folder for Default Domain Policy
and Default Domain Controllers Policy from Sysvol. I'm
not sure that I needed to delete the whole folder but I
was getting a bit desperate...

What really confuses me is that we had successfully
imported policies at several sites previously. (Same
laptop, same backed up policies.)

Thanks for your help.

John

 

[John]

Yep,

That did it...

Thanks very much for your help.