Organizational Unit Controller Cannot Edit Group Policy Objects

ID: Q233548

The information in this article applies to:

Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Datacenter Server
Microsoft Windows 2000 Server
Microsoft Windows 2000 Professional

SYMPTOMS

After you assign complete control of an Organizational Unit (OU) to a user or group using the Active Directory Users And Computers snap-in for Microsoft Management Console (MMC), that user or group may not be able to edit or create Group Policy objects.

NOTE: The user or members of the group can create a new computer, user, group, and printer object in the container.

CAUSE

This issue occurs because the user or group that has control of the OU is not a member of the Group Policy Admins security group.

RESOLUTION

To resolve this issue, add the user or group to the Group Policy Admins security group. To do this, follow these steps:

NOTE: The computer needs to be a Domain Controller to have Active Directory installed and Active Directory utilities available for these steps.

Open the Active Directory Users And Computers snap-in using the MMC tool.

Click to expand the Domain's Directory structure, and then click Users OU to open and view domain users and groups.

Double-click Group Policy Admins

On the Members tab, click Add, and then click to add the user or group you want.

Click OK.

For More information about delegation of Group Policy control, please see the following article in the Microsoft Knowledge Base:

Q221577 How to Delegate Authority for Editing a Group Policy Object

For More information about creating customer MMC snap-ins if Active Directory Users And Computers is not listed in the Administrative Tools of the Domain Controller, please see the following article in the Microsoft Knowledge Base:

Q230263 How to Create Custom MMC Snap-in Tools

STATUS

This behavior is by design.

Additional query words: GPEDIT DCW

Keywords : kbenv kbnetwork kbtool ntsecurity
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbprb