Solved

GPO -  Change Local Admin password policy results with access denied on some machines

Posted on 2013-01-18
7
1,058 Views
Last Modified: 2013-01-29
I've created a GPO for changing the local administrator password on our Windows XP and 7 machines. I'm testing it on a group of 3 computers.

_______________________________________
On my Win 7 pro 64bit I get:
 
"Windows failed to apply the Group Policy Local Users and Groups settings. Group
Policy Local Users and Groups settings might have its own log file. Please click
 on the "More information" link.

For more detailed information, review the event log or run GPRESULT /H GPReport.
html from the command line to access information about Group Policy results."
_________________________________

This is the result of the GP result report:
Component Status
Component Name Status Last Process Time
Group Policy Infrastructure Success 1/18/2013 2:14:35 PM
Group Policy Local Users and Groups Failed 1/18/2013 2:14:34 PM
Group Policy Local Users and Groups failed due to the error listed below.

Access is denied.

Additional information may have been logged. Review the Policy Events tab in the console or the application event log for events between 1/18/2013 2:14:34 PM and 1/18/2013 2:14:34 PM.
 
Registry Success 1/18/2013 2:14:34 PM
Security Success 1/18/2013 2:14:35 PM
_____________________________

The event viewer just says access denied. When I do GP modeling there are no errors.
The other two computers don't give an error but the admin password has not changed.

Any guidance anyone?

Thansk
0
Comment
Question by:mauisun
  • 4
  • 2
7 Comments
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 38794849
Are you also using the GPO to rename the admin accounts??

http://support.microsoft.com/kb/816109
0
 
LVL 1

Author Comment

by:mauisun
ID: 38794855
no. I'm just trying to change the password.
I know that part of the GPO is making it... I've set the enable administrator account property and that shows up when I run rsop on the machine.
0
 
LVL 39

Expert Comment

by:footech
ID: 38794858
Are you applying the GPO to an OU with the specific computers in it?

What do you have for security filtering on the GPO?  If it is a security group with the computers as members, have the computers been rebooted since being made a member of the group?
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 
LVL 1

Author Comment

by:mauisun
ID: 38794880
I'm applying the GPO to a security group with 3 specific computers that are members. Yes. One of the test machines is my own. I've rebooted a bunch of times as well as running gpupdate /force
0
 
LVL 47

Expert Comment

by:Donald Stewart
ID: 38794885
Reason I asked,  was in case some of the admins names were not the same(in synch)
0
 
LVL 1

Accepted Solution

by:
mauisun earned 0 total points
ID: 38815610
I figured it out.
0
 
LVL 1

Author Closing Comment

by:mauisun
ID: 38830332
I figured out that I put too many updates in one policy.
0

Featured Post

Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
How to record audio from input sources to your PC – connected devices, connected preamp to record vinyl discs, streaming media, that play through your audio card: Vista, Windows 7, Windows 8, Windows 8.1 and Windows 10 – both 32 bit & 64.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

932 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now