dsacls.exe

  • Thread starter Thread starter acira
  • Start date Start date
A

acira

Has anyone used the dsacls.exe to remove a GPO? I am
unable to open a GPO due to incorrect settings on the ACL.

I already aquired the distinguished name using adsiedit.

I have articles 294257 and 281146. I just wanted to know
if anyone has experience with this and what were the
results of your maintenance.

Thanks in advance.
 
I have never done it, however, if you are an administrator, you can just
change the permissions on the GPO. I would not try to start deleting GPOs
and the files associated with them.
 
That's the problem.
I can't change the permissions because there is only one
object in the ACL that has read permissions. I'm not
worried since this was an alternate GPO that I was
testing. The "Remove the link and delete the group policy
object permanently" check box is greyed out. I'm just
annoyed with seeing the "inaccessible GPO - access denied"
in the current group object links for my domain.
Any other suggestions?
 
Maybe you are not the owner? The administrator can become the owner, so try
taking ownership. Then, you can change permissions to give yourself
permission.
 
I resolved the problem.
From ADSI Edit dc=<domainname>\cn=system\cn=policies
container, I was able to right-click on the policy and add
administrator to the security tab.

I went back to the GPO for may domain and added the two
GPO objects that were not accessible. I now have full
controll over both of them as administrator.

Thanks for your help.
 
Back
Top