DC GPO Replication errors (ACLs)

[Sheridan]

I seem to have the old problem with GPO replication when you see the error 'The sysvol permisions for one or more GPOs on this domain controller are not in sync with the permissions for the GPOs on the Baseline domain controller' and it lists two GPOs which are our Default Domain Controllers Policy and Default Domain Policy

 

Now I haven't seen this error for a while but after some searching I found the old fix where the GPO sometimes had two sets of permissions for the Domain Admins group and you used the following commands to remove and then re-add the permissions:

 

icacls “{GPO UID}” /remove:g “<localdomain>\Domain Admins

icacls “{GPO UID}” /grant “<localdomain>\Domain Admins”:(OI)(CI)(F)

 

Now this is where I'm not sure what is wrong, as all three of our DCs have the correct permissions for Domain Admins: i.e Domain Admins:(OI)(CI)(F)

 

However the ones that are failing seem to be missing the extra set of permissions that are on the DCs where it is working, namely: Domain Admins:(OI)(CI)(RX,W,WDAC,WO)

 

So the 'working' DCs have two sets of permissions, and the non working ones just the one (just on these two GPOs though)

 

I've loath to remove any permissions from these as they're both top level - as it might block me from re-adding, but I don't know which set is the correct set to apply?