Modifying GPO - Access Denied

[BKGarry]

To All,

 

I am trying to modify a GPO at the moment on a 2003 DC (plans to get rid of that is being made already) all I want to do is turn off the "move current content" settings in the Folder Redirection policies to see if it speeds up logon (as with verbose mode turned on it seems to spend a good 15-20 seconds on applying folder redirection) but whenever I do the change and click apply I get an Accessed is Denied Message, I am a member of Domain Admins and I have looked through the delegation settings for security but I cannot seem to find anything obvious stopping me. Has anyone had this before?

 

Thank you all in advance,

[3s-gtech]

I haven't played with this for a while - I've always made sure that option was firmly off, along with 'Grant user exclusive permissions'. It's the latter I'd be wondering about here - can you access and browse the folder in question via UNC path as your logged in user?

[BKGarry]

Oops should have been more specific, the issue isn't the GPO applying, all the redirection is working, but I want to modify the GPO itself in the GPMC but that is where it is saying access is denied, when I try and click apply there.

[3s-gtech]

Rather odd! Can you edit any other settings within that GPO? I'm wondering if the actual permissions on the policy object in the sysvol are perhaps wrong.

[BKGarry]

All that is in this GPO are those settings, it is rather annoying, there seems to be a Policy Object for every different setting going (I will have to combine them later as it is annoying the hell out of me) but I can access all the sysvol and sub folders within it (double checked the ID)

[3s-gtech]

Can you set this policy within another GPO and ditch this one?

[BKGarry]

I am a little bit scared to do so, this is an old BSF Active directory and I have done that before with something else and it seemed to just go horribly wrong. I really want to save that as my last resort

[3s-gtech]

No harm in just unlinking the GPO rather than deleting it. It does sound like there are some issues with the GP/AD/domain though!

[BKGarry]

Well I created a new GPO imported the settings and I can modify it, looks like I will have to do this way, oh well

[BKGarry]

OK, unlinked old Policy, new one allowed me to edit the settings, and now has sped up my login by 20 seconds, :-) next step is to start almagamating all the GPOs into one for Students and One for staff, it will make things a lot easier I think :-)

 

Thank you so much for yout help

[Gabriel177]

I believe you need to create a user with the credential of an Enterprise Administrator in order to make must of the changes in windows 2003. I would get back and will reply because right now it is late 12:23 am and will research more on the subject on GPO modification..