PLEASE HELP. GPO Policies missing and cant replace - Starting to panic

[edutech4schools]

Hi, Just so you know I look after a few small primary schools and need this explained simply please.

 

Just went to edit our WSUS gpo on our 2012r2 domain server and the path within group policy is missing so I checked the sysvol\domain\policies folder and most of the items are missing.

 

I then downloaded the policies from this link - https://www.microsoft.com/en-gb/down....aspx?id=43413

 

Odd thing is that the download does not contain the GB folder, would that make a difference?

 

Anyway I tried to copy paste into the sysvol\domain\policies and get this error,

Destination folder access denied

you need permission to perform this action

 

I was logged in with my normal user that has domain admin rights. I then created a new user and added that user to the domain admin group, logged out and back in with this new user but get the same error.

 

What on earth is going on, am I pasting to the wrong folder or something.

[Homer]

How many DC's do you have, are they replicating correctly? Anything in the event logs?

[edutech4schools]

Just had the other very old 2008r2 server go down on me. I have no way to restore it so have removed it from the main DC following MS DC removal process.

 

Just checked and the domain functional level was 2008r2. Now I don't have any 2008r2 DC's should I rais the function levels?

[WSRV_Guru]

Unless you have other servers attached to your domain that are are 2008 or below, I'd leave the domain functional level at 2008r2.

[edutech4schools]

Unless you have other servers attached to your domain that are are 2008 or below, I'd leave the domain functional level at 2008r2.

So just leave it.

 

The policies I downloaded to replace the missing ones were for server 2012r2, would the fact the domains functional level be why I could not paste into the policies folder?

[5tu]

How many DC's do you have, are they replicating correctly? Anything in the event logs?

 

^ This.

 

If only one DC you need to be considering an authoritative restore of system data from backup (assuming you have one).

[Homer]

Sounds to me as if the replication was not working correctly before it failed, chances are you were making changes to the policy on the dead DC and the changes did not replicate to the good DC.

 

Unless I am misunderstanding what is going on here, have you actually lost the settings in the GPO, the GPO itself or the admx definitions?

[WSRV_Guru]

The fact that the domain functional level is at 2008r2 would not make a difference, since Windows 2012r2 is supported at the functional level you've got set currently.

 

I'd recommend taking a look at this TechNet article to further understand domain functional levels:

https://technet.microsoft.com/en-gb/library/understanding-active-directory-functional-levels%28v=ws.10%29.aspx

 

Do you just have the one DC or more? Also, do you know which DC is the primary controller?

Edited May 18, 2016 by WSRV_Guru

[edutech4schools]

OK all fixed.

 

I needed my user account to have the administrator group added. Can someone explain why domain admin group was not good enough to copy the files in to the policies folder please.

 

Just to clarify the events.

Went to new server (2012r2) to update our WSUS group policy, Policy settings on the right looked fine but when I went to navigated through Computer Configuration, Policies, Administrative Templates, that was as far as I could navigate both Windows Components, Windows Update. were missing.

 

Found out that you could fix this by replacing the files in sysvol / domain / policies folder but could not paste the new files, started to panic.

 

Remembered our old 2008r2 server in a cupboard at the other end of the school that I had not dcpromo yet so went to check. Logged in but it took ages for me to get in and then DNS would not open AD would not open and I realized the network was not connected. Found out LAN cable had been damaged by a member of staff at some point. As this was about to be decommissioned I took the decision to turn it off and remove all trace of it from our new 2012r2 server. It just seemed the safest option.

 

Anyway I added administrator to my domain account on the new server and was then able to copy the policies to the folder and was then able to browse and edit the policies in GP editor.