GPO -  Change Local Admin password policy results with access denied on some machines

Posted on 2013-01-18
Medium Priority
Last Modified: 2013-01-29
I've created a GPO for changing the local administrator password on our Windows XP and 7 machines. I'm testing it on a group of 3 computers.

On my Win 7 pro 64bit I get:
"Windows failed to apply the Group Policy Local Users and Groups settings. Group
Policy Local Users and Groups settings might have its own log file. Please click
 on the "More information" link.

For more detailed information, review the event log or run GPRESULT /H GPReport.
html from the command line to access information about Group Policy results."

This is the result of the GP result report:
Component Status
Component Name Status Last Process Time
Group Policy Infrastructure Success 1/18/2013 2:14:35 PM
Group Policy Local Users and Groups Failed 1/18/2013 2:14:34 PM
Group Policy Local Users and Groups failed due to the error listed below.

Access is denied.

Additional information may have been logged. Review the Policy Events tab in the console or the application event log for events between 1/18/2013 2:14:34 PM and 1/18/2013 2:14:34 PM.
Registry Success 1/18/2013 2:14:34 PM
Security Success 1/18/2013 2:14:35 PM

The event viewer just says access denied. When I do GP modeling there are no errors.
The other two computers don't give an error but the admin password has not changed.

Any guidance anyone?

Question by:mauisun
  • 4
  • 2
LVL 48

Expert Comment

by:Donald Stewart
ID: 38794849
Are you also using the GPO to rename the admin accounts??


Author Comment

ID: 38794855
no. I'm just trying to change the password.
I know that part of the GPO is making it... I've set the enable administrator account property and that shows up when I run rsop on the machine.
LVL 42

Expert Comment

ID: 38794858
Are you applying the GPO to an OU with the specific computers in it?

What do you have for security filtering on the GPO?  If it is a security group with the computers as members, have the computers been rebooted since being made a member of the group?
Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell® is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.


Author Comment

ID: 38794880
I'm applying the GPO to a security group with 3 specific computers that are members. Yes. One of the test machines is my own. I've rebooted a bunch of times as well as running gpupdate /force
LVL 48

Expert Comment

by:Donald Stewart
ID: 38794885
Reason I asked,  was in case some of the admins names were not the same(in synch)

Accepted Solution

mauisun earned 0 total points
ID: 38815610
I figured it out.

Author Closing Comment

ID: 38830332
I figured out that I put too many updates in one policy.

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

This article provides a step by step guide (with screenshots) showing how to create a new local (test) Administrator user profile in Windows 10 for troubleshooting purposes, and then how to remove it.
In a question here at Experts Exchange, a member was looking for "a little app that would allow sound to be turned OFF and ON by simply clicking on an icon in the system tray". This article shows how to achieve that, as well as providing the same OF…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…

619 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question