Unable to Edit Group Policy

Question

Dear All,

We are facing an issue with group policy. when we try to edit group policy we are getting the following message.

"Failed to open the group policy object. you might not hve the appropritae rights. Details: The network name cannot be found."

Screenshot attached for your reference.

We have 3 domain controller.

Windows server 2012R2 (Was previously primary domain controller).

Windows Server 2016 ( ADC).

Windows Server 2022 (Migrated roles to this server, and currently this is the PDC)

Also , from this two servers we are not able to open group policy.

Windows server 2012R2 (Was previously primary domain controller).

Windows Server 2016 ( ADC).

Can anyone kindly help us to fix this issue.

Thanks and Regards

Faiz

Answer 1

Hello Mohamed Faiz PT,

Thank you for posting in Microsoft Community forum.

1.What is you forest functional level and domain functional level?
2.What is the SYSVOL replication type （FRS or DFSR）?
3.Can you open/edit the same "Default Domain Policy" on server 2022?
4.Can you open/edit other GPO on 2012 R2 or/and 2016?

Please check the AD replication status by running commands below on PDC.
repadmin /showrepl >C:\rep1.txt
repadmin /replsum >C:\rep2.txt

repadmin /showrepl * /csv >c:\repsum.csv

I hope the information above is helpful.

If you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

Answer 2

Dear Daisy

Thanks for the reply.

1.What is you forest functional level and domain functional level?
2012R2

2.What is the SYSVOL replication type （FRS or DFSR）?
DFSR

3.Can you open/edit the same "Default Domain Policy" on server 2022?
I can open, not able edit.

4.Can you open/edit other GPO on 2012 R2 or/and 2016?
No

Kindly visit the OneDrive link to see the log files. Files

Faiz

Answer 3

Hello Mohamed Faiz PT,

Thank you for your reply.

AD replication is OK.

Please check if SYSVOL and Netlogon are shared on three DCs. Please run net share command on three DCs.

It seems there is issue about sysvol replication. Please check If you can open or edit any GPO on any one DC, I mean if there is no issue about opening/editing any GPO on one DC.

https://filestore.community.support.microsoft.com/api/images/6769298c-6a0c-4b0c-a771-c1a1070d3676?upload=true&fud_access=wJJIheezUklbAN2ppeDns8cDNpYs3nCYjgitr%2BfFBh2dqlqMuW7np3F6Utp%2FKMltnRRYFtVjOMO5tpbpW9UyRAwvLeec5emAPixgq9ta07Dgnp2aq5eJbnfd%2FU3qhn54Ui9c7IY3%2BVaDGM794ieFEWFOTytTrMKy7m1XQpeIKlfhHZvv6qxFNypZh8EVO%2BjzMgLRnj7SrY%2FjVoV7qs8fDiK994oMxVrhrFAMYDcU%2FzrRT%2Baf3Ll2q%2Fbu90qGfUbJZk4yU%2Fxeg%2FdyPSS1FTusko6ckZUb6bPFgb0CSJtv0S2KzegXgNWsr5HNLOv3VokCuvE62%2FbRlqCLDtk%2FoYrCagSq%2F8cY7EyXDbzucG505P7xqNHjPstc9MLrEbcRlel6Vy92iE7GPpvQdK8U%2Fb%2FneKFn0F0cgQk1Tv%2BukXvvkC4%3DBest Regards,
Daisy Zhou

Answer 4

Dear Daisy,

I tried to edit GPO in all the DCs, The following are the responses.

1. In 2012 and 2022 i could open the group policy but was not able to edit it.
2. in 2016, the GPO was not able to open.

Kindly advise the next steps to fix this issue.

Thanks and Regards

Faiz

Answer 5

Hello Mohamed Faiz PT,

Thank you for your reply.

1.Please check if SYSVOL replication is OK.

On 2012 R2, create folder1 under \domain.com\SYSVOL\domain.com\Policies
On 2016 create folder2 under \domain.com\SYSVOL\domain.com\Policies
On 2022 create folder3 under \domain.com\SYSVOL\domain.com\Policies

At last, check if folder2 and folder3 are replicated to 2012 R2.
check if folder1 and folder3 are replicated to 2016.
check if folder1 and folder2 are replicated to 2022.

https://filestore.community.support.microsoft.com/api/images/b075c410-7642-40e0-9494-241b62f61367?upload=true&fud_access=wJJIheezUklbAN2ppeDns8cDNpYs3nCYjgitr%2BfFBh2dqlqMuW7np3F6Utp%2FKMltnRRYFtVjOMO5tpbpW9UyRAwvLeec5emAPixgq9ta07Dgnp2aq5eJbnfd%2FU3qhn54Ui9c7IY3%2BVaDGM794ieFEWFOTytTrMKy7m1XQpeIKlfhHZvv6qxFNypZh8EVO%2BjzMgLRnj7SrY%2FjVoV7qs8fDiK994oMxVrhrFAMYDcU%2FzrXdy6Oo3djiqvUqt%2Bx5pzPzaRgQjluzSQV4JRWbt9ngO%2B9yeK55YBCLFq7V5LRem6s41S5yWNfyPasMZ5eItqVyDtcp3S%2FaMOjU3dtvqu4ys14DNu1MzQsJvwqqiMLDyWpv4kguDIcl34YZKuZ%2FxOHgPiDVNTT%2BVtG2wmvpP1WmwKH%2F%2BwfLDw6d%2FOCa5pxgTg%3D2.Check if the {GUID} related to GPOs under \domain.com\SYSVOL\domain.com\Policies are the same on all DCs.

There are 6 GPOs in my domain.

3.And check if the GPO you are editing is in \domain.com\SYSVOL\domain.com\Policies on DC?

Best Regards,
Daisy Zhou