Mistyped the Inherited/ inherit ACE flags there, but you get my point -kind
of makes sense in English.
I'm guessing, as I'm not in a position to test, that perhaps GPPREP adds the
necessary ACE(s) to the aforementioned container, resulting in an ACE set
with the INHERIT flag, which means that child objects will inherit this ACE
(unless NO_PROPOGATE is set, which is isn't).
--Paul
----- Original Message -----
From: "Paul Williams" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Wednesday, November 22, 2006 10:31 AM
Subject: Re: [ActiveDir] Enterprise Domain Controllers group missing...
I imagine you used the version of ADPREP that ships with Windows Server
2003 SP1?
I believe you need to run ADPREP /DOMAINPREP /GPPREP.
This will add the inheritable ACEs to CN=Policies,CN=System,DC=...
Allow: NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERS Read is an inherited
ACE.
Re. EDCs.
ENTERPRISE_DOMAIN_CONTROLLERS Security Principal is available with Windows
2000. The new Security Principals added by 2003 are:
. LocalService
. NetworkService
. NTLM Authentication
. Other Organization
. Remote Interactive Logon
. SChannel Authentication
. This Organization
These group memberships are also modified:
. The Network Servers group is added to the Performance Monitoring
Users group.
. The Enterprise Domain Controllers group is added to the Windows
Authorization Access group.
See the link from Steve for more info. on this. 2003 RTM added new Sec
Prins. 2003 SP1 also added some, IIRC. Therefore ensure your PDCe is
running k3 SP1.
--Paul
----- Original Message -----
From: <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Wednesday, November 22, 2006 2:04 AM
Subject: [ActiveDir] Enterprise Domain Controllers group missing...
- We recently upgraded the schema in one forest from Windows 2000 to
Windows 2003.
- We now receive the following error when trying to access group
policies,
"The Enterprise Domain Controllers group does not have read access to
this
GPO. The Enterprise Domain Controllers group must have read access on all
GPO's in the domain in order for Group Policy Modelling to function
properly. To learn more about this issue and how you can correct it,
click
Help.".
- I can confirm we do not have an "Enterprise Domain Controllers" group
in
any of the domains.
- I have found the following article "
http://technet2.microsoft.com/WindowsServer/en/library/b44ba1b5-9f85-4bee-84c9-1994921658cd1033.mspx?mfr=true
" which shows how to fix the GPO issue using
"GrantPermissionOnAllGPOs.wsf"...but this assumes we actually have the
group "Enterprise Domain Controllers" available. From further reading I
see this group has a specific SID of S-1-5-9 so I can not simply create a
new group.
- Does anyone have any idea how the group "Enterprise Domain Controllers"
can be recreated with the correct SID of S-1-5-9 so that we can run the
script "GrantPermissionOnAllGPOs.wsf" to fix the group policy problem?
Thanks in advance,
Matt Duguid
Systems Engineer for Identity Services
Department of Internal Affairs
Phone: +64 4 4748028 (wellington)
Mobile: +64 21 1713290
Fax: +64 4 4748894
Address: Level 4, 47 Boulcott Street, Wellington CBD
E-mail: [EMAIL PROTECTED]
Web: http://www.dia.govt.nz/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/[email protected]/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/[email protected]/
