We help IT Professionals succeed at work.

dcgpofix not working -getting  ldap error

hclgroup
hclgroup asked
on
Medium Priority
1,570 Views
Last Modified: 2010-08-05
today i denieid the apply group policy and the read permissions to the enterprise admins group for the default domain policy gpo with the hope of blocking certain settings from that group, what happened after was the gpo immediately went to "inaccessible", and the policies set to be applied across the domain were not applied tot the whole network. i deleted the link from the gpmc console then i went to the sysvol folder found the corresponding policy sid folder and gave the enterprise admin full control. i then ran the dcgpofix command and i am getting this error "could not open active directory object ldap:// etc" the specified sid id folder here have all the appropriate permissions. i need to know where else do i need to go to make changes so the command will follow through.

the default policy had some very important settings like the firewall on it so i recreated anothe rgpo linked it to the domain and put the settings on it, this works across the domain but if i go to the control panel/admin tools /domain security policy..........................i get an error because the shorcut still points to the original folder, i changed this on one dc to reflect the new gpo i created. which it then opened the the gpo for modification.


i still need to restore the original default policy please help,,,,,,,,,,,,,,,my solution is only a temporary one.
Comment
Watch Question

CERTIFIED EXPERT
Top Expert 2005
Commented:
Find the GUID in ADUC (Advanced View) under System>Policies.

Add back Domain Admins, Enterprise Admins and SYSTEM (full control).

Not the solution you were looking for? Getting a personalized solution is easy.

Ask the Experts

Author

Commented:
i found re-applied the permissions and i realise that in the permissions list the apply group policy object is not there,,,,,,,,,,,,,,,,,,there are only folder permissions
CERTIFIED EXPERT
Top Expert 2005

Commented:
Those "folder" permissions are actually the ACL on the Policy itself.  Once those groups have access, you should then be able to edit them.

Author

Commented:
thanks netman,,,,, the problem was i had some special permissions denied...how i don't know once i allowed full control on everything for the enterprise and domain admin the dcgpofix went through and the old default policy showed up. this was strange because when i looked earlier in my gpo backup folder it was not there. once i ran the command it ws listed in the group policy objects ad i was able to restore it from two days ago.
CERTIFIED EXPERT
Top Expert 2005

Commented:
Excellent.

Glad to help.
NM
Access more of Experts Exchange with a free account
Thanks for using Experts Exchange.

Create a free account to continue.

Limited access with a free account allows you to:

  • View three pieces of content (articles, solutions, posts, and videos)
  • Ask the experts questions (counted toward content limit)
  • Customize your dashboard and profile

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.