Issue deploying ipam gpo

Question

I’m trying to run Provision‑IpamServer, but it keeps failing to deploy the required group policy objects in child domains and logs Access Denied. i’m wondering how to manually assign the necessary active directory permissions so ipam can manage across domains.

Could this be related to missing delegation rights or blocked inheritance on the system container ?

Answer 1

Hello Lea,

Yes, the “Access Denied” error during Provision‑IpamServer almost always points to insufficient delegation rights in Active Directory. IPAM requires permissions to create and link GPOs in each domain where you want to manage DHCP/DNS servers. By default, the provisioning wizard attempts to create three GPOs under the System\Policies container in each domain. If the IPAM server account doesn’t have rights there, the deployment fails.

To resolve this, you need to manually delegate permissions. In each child domain, open Active Directory Users and Computers, enable Advanced Features, then right‑click the System container and choose Delegate Control. Add the IPAM server computer account (or the IPAM administrators group) and assign Create/Delete Group Policy Objects and Link Group Policy Objects permissions. Also confirm that inheritance isn’t blocked on the System container or on the OU where DHCP/DNS servers reside, because IPAM needs to apply those GPOs down to managed servers.

If you prefer PowerShell, you can use Set-GPPermission from the GroupPolicy module to grant the IPAM server rights on the GPOs once they exist. But the critical step is ensuring the IPAM server account has delegation at the domain level before running Provision‑IpamServer. Without that, the cmdlet cannot write into child domains.

So yes, missing delegation rights or blocked inheritance on the System container is exactly what causes this. Correct the delegation, re‑run Provision‑IpamServer, and the GPOs should deploy properly across domains.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HL.