1

I may have blundered a GPO towards the end of my shift.

A fairly important (at least to me and future weeks) had its links go red and unreachable after I altered Delegation settings on a specific normal user.

The GPO itself warns of SYSVOL security discrepancies.

I went through ADSI in System\Policy\GPO GUID and Domain Admin has total control on the object, yet no class is shown and no attributes. The icon is also different.

Can only see the Security tab and the security options are not the same as on other policy objects who still have their class showing.

When attempting to delete the GPO it says attribute / value not found and does not delete it. Some recommendation for deleting GPOs were to delete that object but since there is already something "wrong" with it. I am worried about it and this is production on primary domain controller...

Any help would be appreciated.

It was not a good way to end the day, which continued once I was home and I would like to understand. It's now passed 11pm and not looking forward to tomorrow. System\Policy Gpo Object

paypercorn
  • 13

2 Answers2

0

A GPO has two components, one in AD and the other on the file system in a subdirectory under SYSVOL\Policies. The directory permissions for the GPO also need to be changed to enable recovery.

Greg Askew
  • 39,132
0

Escalated and confusion ensued, backup resolved the problem. "GPO corruption present themselves in a variety of ways" was my only answer. Eh that will do, work can continue.

paypercorn
  • 13