AGPM group policy ownership problem

Im trying to move uncontrolled policies to controlled but I get [GPMC Error] Could not take ownership of the production GPO. Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) on all of them. Per the docs, my service account
is a member of the "GPO Creator Owners" group and "Backup Operators" group. I have also given full control of the container the policies are in to the service account. I am able to create new controlled policies and deploy them, I just cant
seem to take control of production GPOs even though it looks like the rights are there.
Anyone have any ides?

Hi Dave,
you also need to get the service account full controller over the existing GPOs:
Full Access to existing GPOs
http://blogs.technet.com/askds/archive/2008/12/16/agpm-least-privilege-scenario.aspx
AGPM ensures that it has proper ownership and permissions to all controlled GPOs. However, GPOs created before implementing AGPM will not provided adequate permissions to the AGPM Service. For this reason, you'll want give the AGPM Service
Full Control to all GPOs that exists prior to implementing AGPM.
That should fix it.
Gunter

Similar Messages

Windows 8.1 mandatory profile Group Policy printer problems

We're a school district that is using mandatory profiles for the students. We use both Win 7 and Win 8.1 on the workstations. We're having a problem with group policy printer deployment on just the Windows 8 Workstations. I've tried using both the deployment
method in policies and the Preferences with Item level targeting and on the windows 8 ones its always intermittent. Sometimes you login and get the printers or some of them and sometimes not. Other times if you log out and back on etc. I've been troubleshooting
this for a week and have found with Win 7 it seems to always work but on our Win 8.1 ones about 50/50. The error in the Event log for that printer is this.
Group Policy Object did not apply because it failed with error code '0x80070057 The parameter is incorrect.' This error was suppressed.
What I've found that if I create a test account that does not use the mandatory profile the printers always map. Even on Windows 8.1. So far thats the only commonality. Can anyone tel me what I can look at with this. If they never worked that would be an
easier problem but its not consistent.
Thanks
Jason

Hi Jason, Did you ever find a fix for this as we are having exactly the same problem only with windows 8.1 computers using mandatory profiles and it's driving me mad. Any help would be much appreciated Thanks Dan

Group Policy Editor problem

Hi
I updated Windows 7 SP1 Enterprise 64 bit
with the Windows Update.
Now, when I open the Group Policy
Editor, this window is displayed with the
following error message:
How come?
Thanks
Bye
Balubeto

Hi,
Apologize for the late reply.
The error message seems to be related with some updates that didn't update the Admx related files. The error was aften caused by mis-matched ADMX and ADML files.
See this similiar thread:
Error when selecting administrative template in any GPO
https://social.technet.microsoft.com/Forums/windowsserver/en-US/bac54114-54d7-472b-969d-9b08f28dbba9/error-when-selecting-administrative-template-in-any-gpo?forum=winserverGP
For the inetres.admx, line 1495 column 249, please follow the suggestions mentioned in the above thread. Unzipping the download (THIS ONE
http://www.microsoft.com/en-us/download/details.aspx?id=40905), then copy the related language\inetres.adml file to the c:\Windows\PolicyDefinitions\language directory, overwriting
the existing one in the destination.
Best regards
Michael Shao
TechNet Community Support
When I try to execute the copy commands via the command prompt with elevated privileges, the "Access Denied" error is displayed. How come?
Thanks
Bye
Balubeto

Event ID 5002/5014 Group Policy DFSR problem

I have 4 domain controllers all are running on windows server 2012. RPC always disconnects/fails having error event Ids 5002 and 5014. AD objects are replicated across DCs but on Group policy DCs are either inaccessible or differ in GPO Version.
thanks for the help.

Good. Okay, then it's just the 5014's & 5002's.
Here's a wiki on 5002:
http://social.technet.microsoft.com/wiki/contents/articles/1207.dfsr-event-5002-dfs-replication.aspx
On the 5014, there should be a corresponding error number. Can you please respond with that and the specific error messaged (edited for privacy, of course.)?

Group Policy Preference: Problem Adding Network Locations

Group Policy Preferences (GPP) do not currently support correctly creating shortcuts in Network Locations/My Network Places the way Windows produces them when you go through the "Add a network location" wizard. Unfortunately, the GPP simply creates a standard shortcut instead of creating a folder that contains target.lnk and desktop.ini (the way the "Add a network location" wizard does).
I was curious to know when the GPP engine will be updated to correctly add Network Locations the way the "Add a network location" wizard does?
Thanks.

Talfr77,
I would like to know what environment you tried this under. I made policy like you described on a 2012 domain controller and the resulting shortcut worked fine on windows 8 clients and on the 2012 servers.
However, the 2008 servers and windows 7 clients didn't work. They simply got a folder with two files. It would appear that the format of the target.lnk file may be different between versions of windows. I took a target.lnk from a
working shortcut made on a 2008 server and put in on a 2012 server and the result was it not recognizing the shortcut.
It is also worth noting for anyone who wants to try this method, that in step 2 of Talfr77's directions he says to copy the desktop.ini file using the GPP file copy function to the subfolder with the target.lnk file. He didn't mention how to accomplish
that. You can store the desktop.ini file anywhere on your network as long as the UNC path to it is accessible to the user. I suggest you store it right in a subfolder of the GPO in the sysvol to keep things tidy. So that UNC would be the
source path. (example would be \\domain.local\SYSVOL\domain.LOCAL\Policies\{020DBAF4-2631-4246-8811-DE02F7613959}\desktop.ini) The destination path will be %appdata%\Microsoft\Windows\Network Shortcuts\<Subfolder name>\desktop.ini
The same goes for his step 3 where you edit the folder attributes. The folder you want to edit is %appdata%\Microsoft\Windows\Network Shortcuts\<Subfolder name>
Karl

ZENworks 6.5 SP1b And Group Policy Editor Problems

I just installed ZENworks 6.5 SP1b on a brand new test server that I am
running. I have no users or strain on the server. After I installed the
service pack it started take about 20 to open the Group Policy Editor for
a user policy and about a minute 20 to close it. I was using it before the
upgrade and it only took like 10 seconds to close before. What's up? Can
any one help?

Yeah Sorry I clicked the wrong one
> I presume someone will help in the Desktops forum, since this is for
> server management...
>
> --
>
> Shaun Pond
>
>

November updates cause error in IE group policy files

Hi,
I reinstalled Windows 8.1 with Update today and noticed an error after installing either the IE 11 cumulative update or the optional November rollup update package. The error pops up only if either or both are installed. If they are uninstalled, the error
no longer appears.
The error pop up displays when group policy editor is opened,
"Resource '$(string.VerMgmtAuditModeEnable)' referenced in attribute displayName could not be found. File C:\windows\PolicyDefinitions\inetres.admx, line 1495, column 249."

Hi Sahil,
This issue is related with the ADMX files of Internet Explorer. The error was often caused by mis-matched ADMX and ADML files.
Here is a similar thread for reference: Group Policy Editor problem
The fix:
Unzipping the download (THIS ONE
http://www.microsoft.com/en-us/download/details.aspx?id=40905), then copy the related language\inetres.adml file to the c:\Windows\PolicyDefinitions\language directory, overwriting the existing one in the destination.
Best regards
Michael Shao
TechNet Community Support

Having problem with svchost.exe/ntdll.dll errors causing GPSVC (Group Policy Client) to crash preventing users from logging into the server.

Recently (within the past 2 weeks) I have noticed a few of our servers will have problems with the svchost.exe application causing the GPSVC (Group Policy Client) to crash. The only fix at that point is to reboot the server since the GPSVC service is tied
to svchost.exe and therefore is protected from being manually restarted.
I noticed the following errors when this occurs:
Log Name: Application
Source: Application Error
Date: 7/23/2013 4:35:26 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Server1.xxx.xxx.net
Description:
Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x46c
Faulting application start time: 0x01ce877f9476ac07
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: d252d26d-f372-11e2-8ad4-005056ac00e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-07-23T08:35:26.000000000Z" />
<EventRecordID>158950</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW19XM2.agency.nwie.net</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>46c</Data>
<Data>01ce877f9476ac07</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>d252d26d-f372-11e2-8ad4-005056ac00e8</Data>
</EventData>
</Event>
All of our servers are running Server 2008 R2 Enterprise where we use Citrix to deliver desktop sessions to our users, but some are virtual and some are physical. This seemingly impacts our virtual machines more, and our VMs are hosted through VMWare, however,
about 5 months ago a similar error fired on a non-virtual machine:
Log Name: Application
Source: Application Error
Date: 2/27/2013 6:57:58 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: AAW29033
Description:
Faulting application name: svchost.exe_gpsvc, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x6c0
Faulting application start time: 0x01ce14e1af313fd9
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: ed3d01c4-80d4-11e2-9128-b499baa9e5e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-27T11:57:58.000000000Z" />
<EventRecordID>286291</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW29033</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe_gpsvc</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>6c0</Data>
<Data>01ce14e1af313fd9</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>ed3d01c4-80d4-11e2-9128-b499baa9e5e8</Data>
</EventData>
</Event>
I've searched and cannot seem to find any information as to what may be causing this, or even really where to start. Would someone be able to help me identify what might be causing this event, specific with the Exception code: 0xc0000024, which causes
the Group Policy Client service to stop?

You still out there looking at things? If so I have an update. The issue hasn't stopped, even though it did seemingly die down for awhile, however, it is now back with a vengeance.
I am able to force it to happen by killing the svchost process that is hosting GPSVC. If I run gpupdate /force, then logout/login it does get GPSVC running again. Furthermore, if I simply start svchost again via the Task Manager GPSVC starts running again.
When I access the server remotely with KVM it acts just like it does as if I'm logging into it via Citrix/RDP which for Admin IDs gives an error saying "Failed to connect to a windows service. Windows could not connect to the Group Policy Client service...",
however, normal user accounts just get a message when logging into the server "The Group Policy Client Service Failed the Logon. Access is denied."
I haven't opened a case with Microsoft yet, but we about ready to because of the increase in these errors.
If you have any further suggestions that would be great, otherwise I'll provide an update once I get word back from Microsoft.
**EDIT -- apparently I mistook the the server's SCM's actions as my own. I was able to successfully crash the GPSVC service by killing the hosting svchost process, however, after I crashed it and let it sit crashed for awhile when I attempted
to restart either by starting a svchost task, or running gpupdate /force it failed. Either that, or there is a timing issue where if we don't restart the svchost process, or run gpupdate /force quickly enough it won't be able to recover without a reboot.

Launch problem opening PSE 13 from a read only desktop applied by group policy

PSE 13 won't launch. What is different between opening PSE 13 and other programs? On a normal login it opens. Are there special requirements?

Hi,
Thanks for posting your issue in the forum.
Based on your description, I suspect that maybe Software Restriction Policy has been configured in the domain. At this time, I suggest we could try to collect the following information to narrow
down the cause of the issue.
GPMC.log
==================
a. On domain controller, click Start ->Run, type GPMC.MSC, it will load the GPMC console.
b. Right click on "Group Policy Result" and choose wizard to generate a report for the problematic computer and user account (please place appropriately). (Choose computer and select the proper
user in the wizard)
c. Right click
the resulting group policy result and click the "Save Report…" => save report to save the report to a HTML file.
Once we get the report, please check if the Software Restriction Policy has been configured and applied to the problematic computers and users. If so, please disable the policy setting to see
if the issue persists.
In addition, please try to refer to the following articles for detailed information about Software Restriction Policy and how to troubleshoot Group Policy problems.
Software Restriction Policies
http://technet.microsoft.com/en-us/library/hh831534.aspx
Troubleshooting Group Policy Problems
http://technet.microsoft.com/en-us/library/cc787386(v=ws.10).aspx
Hope this helps.
Best Regards,
Andy Qi
TechNet Subscriber Support
If you are
TechNet Subscription user and have any feedback
on our support quality, please send your feedback here.
Andy Qi
TechNet Community Support

Wireless Group Policy Problem - Half the policy applying

Hi
I'm at a loss for where to investigate this one so I'm hoping for some suggestions.
We have a single GPO to send out settings for wireless access to our network. On the wireless we have two SSIDs as below.
1. Staff SSID
My manager wanted to reduce the security issues with this as much as possible, so I've generated a GUID for the SSID name, set it not to broadcast the SSID and set the group policy to show the network as "<company
name> Staff". It uses WPA2-Enterprise with RADUIS authentication to silently pass the authentication credentials of the currently logged on user providing SSO.
2. Guests SSID
This uses a preshared WPA2 key and provides guests with internet access and is blocked from the local LAN.
The GPO is applied in such a way that company laptops are have the Staff SSID displayed in the available connection list, they're allowed to connect to it (as long as they're in the appropriate AD group for RADIUS authentication) but they are blocked from
connecting their laptops to the Guests SSID. The important thing is that this single GPO controls both settings.
On a few laptops we have been noticing that the blocking of the Guests SSID is working fine, but the Staff SSID is failing to show. Its as if only half the policy is applying. This is happening to only a small number of laptops which reside in the same AD
OUs and it doesn't matter who logs on, the same problem occurs. The laptop is able to view all other wireless networks in the vicinity.
I have logged in to one as myself (with Domain Admin permissions) and I get this problem, but on other laptops, the policy applies completely allowing me to connect to the Staff SSID while blocking the Guests SSID, as it should.
I've run a RSOP against the laptop which shows that the policy is applying (confirmed by the fact that the Guests SSID is blocked) and the only problem I can find in the event logs are for the EapHost service with event ID of 2002. I've followed the advice
in a few forum posts below but have been unsucccessful (not even sure if it's related to the GPO issue).
http://www.eventid.net/display-eventid-2002-source-Microsoft-Windows-EapHost-eventno-10874-phase-1.htm
http://www.sevenforums.com/network-sharing/336450-event-id-2002-source-eaphost-eap-method-dll-path-name-failed.html
Any suggestion would be greatly appreciated.

Hi Daverino,
Since RSOP shows that the policy has been applied, it should not be a grouppolicy issue.
According yourdescription, it seems that the system of the laptop has been changedby the user data.
Could you please post the original information about event 2002? It is useful for further troubleshooting.
Best Regards.
Steven Lee
TechNet Community Support

Group Policy upgrade to SP2 problem

Hi guys,
We are having the following issue. We have upgraded our XP group policy to SP2. Now each time users login, the first thing they see is a 'restrictions' window saying "this operation has been canceled due to restrictions in effect on this computer."
I wonder how I can figure out which group policy setting is causing this? The same policy worked when the policy was an SP1 policy, but once updated to SP2 it will give that error message. Thank you.

Jakub,
It appears that in the past few days you have not received a response to your posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at http://support.novell.com in both the "free product support" and "paid product support" drop down boxes.
- You could also try posting your message again. Make sure it is posted in the correct newsgroup. (http://support.novell.com/forums)
If this is a reply to a duplicate posting, please ignore and accept our apologies and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Fireworks 8 Installation Problem via Group Policy

Hi,
We are trying deploy Studio 8 across our site using the
provided MSI's and Group Policy following this guide -
http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=332882
I have created the mst files for all products and set them to
be deployed by group policy. Dreamweaver, Flash, Contribute, Flash
Video Encoder and Flash Extensions Manager all install fine however
Fireworks will not, looking in the event log it doesn't even
attempt to install. All folders have the same permissions, the MSI
& MSTs are all part of the same Group Policy Object using the
"Software Installation" method with the same permissions.
Fireworks will install using MSIEXEC from the command line so
the package and mst are fine.
Has anyone else come across this problem?
Thanks
Matt

We are having the same issue here at our NSW High School. I
have traced the problem to be that Fireworks wants to deploy in
Chinese (instead of English) and because of this it will not
install. I am looking for a way to convert the msi file to an mst
so I can choose English as the default install language.
Hope this info is useful

Active-X update group policy problem

I am having problems distributing
install_flash_player_active_x.msi via a group policy in our MS AD.
I am familiar with creating GPOs. I used a GPO to distribute
Adobe Reader without any problems, but this active-X update will
not apply via a gpo. The error I get is: The install of application
Adobe Flash Player 9 ActiveX (2) from policy Adobe_Flash_Patch
failed. The error was : The installation source for this product is
not available. Verify that the source exists and that you can
access it.
I created an administration install and used the same shared
distribution folder as I did for Adobe Reader so I know that this
error is not due to permissions. Any help would be gratefully
appreciated.

> 9. The Database Security Editor appears. You need to add the user or
> group that you want the *Security* tab to be removed from.
What EXACT group was entered in your GPO there?
And if you want to revert, it is most probably NOT sufficient to simply
unlink the GPO, but you need to implement a second GPO that grants the
required read rights (aka "removes the deny entry")
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Flash 10 msi problems through Group Policy

Here's the problem:
We've signed up to Adobe to get there official corporate Flash and Shockwave msi's for network distribution. They have been set in Group Policy and sent down to our machines. It says its installing and when you check add\remove programs both are installed. Some flash\shockwave sites are fine others say that flash 10 is not installed 'do we want to update' or we get this message "can't verify publisher.. swflash.cab". If logged on as an administrator we can run the update and all is fine, this however defeats the purpose of the GP distribution.
When the msi's are run manually on a machine they work perfectly, so the problem exists while being sent through Group Policy. The clients\PC's are running XP and are fresh builds (there are no older versions of Flash on them).
I've looked online for similar cases, but nothing. Has anyone else encountered this issue? or have any ideas why the install will not fully go down?

Don't worry, I've sorted it.
An ex employee had created a package with flash 8 installing alongside\inside another one (totally unrelated to what should have been going down). Which meant the flash 10 was getting overwritten. It's been removed, and everything works fine.
Bye.

"Group Policy Service & Permission Problems" I Will Never Buy Microsoft Windows Computers Again..

I am trying to get some last bit of use out of my Worthless Microsoft Windows Software.. I have spent more time attempting to make this worthless junk work, than I ever get using the computer for what it is designed for.. Both My Windows 7 Pro,
and my Windows 8.1 are the worst products Microsoft has come out with ever.. I started out using Punch Card Machines, in the 70's that worked better than the junk Microsoft is selling us today.. The last 13 computers I have purchased with Windows software
are all in the dumpster. Their tech support is worthless, and half the time you get sent from one phone number to another, and no one knows anything.. I have purchased two sets of software from Microsoft store that have turned out to be Non-Genuine, I paid
full price for, have receipts of sales, dates, validation key numbers, and still spend three days in a row trying to explain to the other end that my software they sold me is shit, and no one understands.. And on top of that will not give me a e-mail address
to send them a copy of the proof of purchase to them for my file, and to prove to them they are selling shit, and they will not give me a address to send them their problems plagued software.. I have three sets of software that i downloaded,
and had disk sent as backups that have bad validation keys, and Microsoft will not honer their sales, and will not give me keys that work..
If it dose finally work, I can not get the "Diagnostic Policy Service" to start, this online troubleshooting will not work, never has worked on windows 8, nor have I ever had any sound on the same computer, nor has my Windows Media
Player ever worked either.. Both Win 7 Pro, and Win 8.1 Group Policy will not let me download anything on the C-drive that can possibly repair what is wrong with the Crap at hand, Their my computers, but I have no permission to do a goddamn thing to repair
what is wrong with it,,I do not want to read another fucking article on tech shit, I want to know how to delete "Group Policy" from every machine I have, because its only purpose I see it to keep me from using my machine , and forcing me to have
to sit on hold and listen to those idiots on the other end just say its another 99 bucks to fix something that I have already given them 99 bucks several times before to fix nothing.. WTF, I was never a fan of Bill Gates, but today he looks like a genius compared
to who/what is working there today.. Dose this happen to everyone, or am I just jinxed? Can someone give me a patch or something besides another article to make this shit work.. Thanks, Barnstormer2790

Wouldn't think anyone wants to help you at all with that attitude - Microsoft products work just great for me.
perhaps you should look closer to home for the issues you have!! Im Out!!!!

AGPM group policy ownership problem

Similar Messages

Maybe you are looking for