Cannot make changes to Group Policy Manager on the DC

Posted on 2008-11-16
Last Modified: 2013-12-05
The root Domain Controller is on it's last leg. We installed a new server as follows:
Currently have 2 Windows 2000 servers running AD.
Move FISMO roles to second Windows 2000 machine.
Run adprep for Forest and Domain. Ran Adprep /domainprep /grpprep
Connected WIndows 2003 server to network, joined domain, installed active directory. Moved FISMO to the 2003 machine.
Problem: Trying to install the Symantec EndPoint Protection Management console and ran into a snag. Per Symantec, I need to be able to make changes (add a user) in the Group Policy editor (within the security settings). When I Open this window, the Add a user option is GRAYED out.  I noticed that all item from Security Settings on have a LOCK on them. How do I enable this option (remove the lock)
Question by:Dubbi47
    LVL 31

    Accepted Solution

    You are trying to use local policy editor on DC that has a GPO applying the policy setting.
    Run rsop.msc to see what GPO is applying the setting.
    Edit the GPO by using ADUC->OU->Properties->Group Policy or use GPMC downloadable at

    Author Closing Comment

    This utility helped, however, It did not solve the complete problem. I was still LOCKED out to make changes.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Suggested Solutions

    Know what services you can and cannot, should and should not combine on your server.
    Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
    This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    22 Experts available now in Live!

    Get 1:1 Help Now