Home / server / Questions / 31857
Accepted
Jason B Shrout
Asked: 2009-06-26 12:41:18 +0800 CST

GPO Policy Object removal 'Unwilling' to process the request

  • 772

This is a tough one in which I don't think anyone can find the answer for, not microsoft yet at least...

There is a Group Policy Object on the primary domain controller, and when I say primary, its got all 5 roles in ownership, and everytime I go to remove the old group policy I get a confirmation, and say 'yes' and than the server response with a window'

Group Policy Management

'The Server is unwilling to process the request.'

So my question is how do I go about removing this policy?

windows-server-2003 group-policy active-directory

2 Answers

  1. Best Answer

    My psychic powers triumph again. >smile<

    You're trying to delete the GPO "{6AC1786C-016F-11D2-945F-00C04fB984F9}". That GPO is the "Default Domain Controllers Policy". It might have been renamed, but that GUID is always assigned to that GPO during DCPROMO and never changes.

    AD is "unwilling" to delete that GPO because Microsoft designed it that way.

    My advice is to return that GPO to "stock" settings, rename it back to "Default Domain Controllers Policy", see that it's linked only to the "Domain Controllers" OU, and leave it alone.

    You can use the DCGPOFIX.EXE utility (see http://technet.microsoft.com/en-us/library/cc736813(WS.10).aspx) to return the "Default Domain Policy" and "Default Domain Controllers Policy" back to their default settings. If you do decide to do that, be sure you save a copy of the settings report from the GPOs as they sit before you run DCGPOFIX so that you can create addt'l GPOs with your customizations in them.

    In general, I highly recommend not making any modifications in these two default GPOs. If you don't modify them, and all else fails, you can always disable all your other GPOs and get "stock" behaviour for troubleshooting. (Can't say I've ever needed that, but it's nice to know it's there...) You can modify the default GPOs, but I recommend just creating addt'l GPOs with the customizations you need and assigning their priority appropriately.

    • 5

  2. What probably happened is copied the default domain controller and then renamed the new one and then used it to create a policy then wanted to deleted it I have seen quit few people do this.

    its actually poor design that server allows you to make policy in this manner form the original if it does not allow you to remove them also.

    The Fix for the issue -

    there is a way to delete ones you copied of the default domain GPO

    go to the objects delegation - remove all the permissions - It should not let you do the permissions called system but you can try it did not allow me to do it for policy object.

    then hit delete you will get error saying the object is not there or along those lines let system sit for while try it again, should get message saying it is not there, then hit refresh button.

    the object should just magically vanish, from the list.

    this worked for me many times when cleaning up copies

    • -1