Solved

Group Policy MachineCNF

Posted on 2016-09-27
1
29 Views
Last Modified: 2016-10-02
In ADSIEdit unter 'System\Policies' I have some Conflict Objects (MachineCNF). Can they be safely deleted?
0
Comment
Question by:albatros99
1 Comment
 
LVL 5

Accepted Solution

by:
sAMAccountName earned 500 total points
ID: 41818057
They can, but dont use ADSIEdit.  Thats a jackhammer when a finish hammer is sufficient.  (Im a strong poroponent of never using ADSIEdit since theres no real input validation and typos can be catastrophic).  You can easily delete them using explorer or powershell.  

It's important you make sure the conflicting item that matches the CNF-<GUID> has the proper contents before you delete the CNF-{GUID} folder... S, for each CNF-{GUID} policy object folder, you should have a corresponding folder with the same {GUID}.  Use gmpc to view the policy that corresponds to the GUID to make sure the settings are correct, then use a workstation that should be in the policies scope to make sure its applying correctly.  If everything checks out, you can delete it...

If you do this, its best to do it on the PDC which is the authority for group policies and the DFSr replication group.  Doing it elsewhere can cause more CNF folders to appear (though this is more likely in large volatile environments)
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

There are two modes of restricted groups GPOs. Replacing mode:   Additive mode:   How do they work? Replacing mode: Everything (users, groups, computers) that is member of the local administrators group will be cleared out. After th…
Find out how to use Active Directory data for email signature management in Microsoft Exchange and Office 365.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now