cannot ammend Default domain policy (password maximum age) - get an error - access denied

Question

Hi all,

I am trying to amend our default domain policy. I have been able to do this previously on our 2012 DC, but since then we have created a new 2016 DC.
Every time I try to amend the default domain policy I get an

Access denied message
Failed to Save
*****GptTmpl.inf make sure you have the right permissions to the object.

I have switched off AV on the server but still getting the same issue.

Any guidance appreciated.

Answer 1

Hi，
The error happened only for the default domain policy or all the policies?
When you added the new DC, did you confirm the health status , you can run the following commands :
Dcdiag /v >c:\dcdiag1.log
Repadmin /showrepl >C:\repl.txt
Repadmin /showreps * 
Repadmin /syncall /APeD

If the new DC is good and it was only for the default domain policy , i would suggest you check the permission ,by the following way：

1. Click Start, point to Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2. In the Active Directory Users and Computers window, on the View menu, click Advanced Features.
3. In the left pane, expand System, and then click Policies.
4. In the right pane, right-click the GPO folder that you want to modify, and then clickProperties.
5. Click the Security tab, and then click the group in the Group or user names list for which you want to set the access permission.
6. In the Permissions for Authenticated Users list，check if the authenticated users have the read,write, and apply permission.
   Then check ,In Windows Explorer, locate and then click the following folder:
   %SystemRoot%\SYSVOL\sysvol\<var>DomainName</var>\Policies
   Note In this folder name, <var>DomainName</var> is the name of the domain.
   In the right pane, right-click the GPO folder that you want to modify, and then clickProperties.
   Click the Security tab, and then click the group in the Group or user names list for which you want to set the access permission.
   Compare the permissions on the file and on the folder with your working GPOs.

Best Regards,