GPO Policy Object removal 'Unwilling' to process the request

Question

This is a tough one in which I don't think anyone can find the answer for, not microsoft yet at least...

There is a Group Policy Object on the primary domain controller, and when I say primary, its got all 5 roles in ownership, and everytime I go to remove the old group policy I get a confirmation, and say 'yes' and than the server response with a window'

Group Policy Management

'The Server is unwilling to process the request.'

So my question is how do I go about removing this policy?

Solution

My psychic powers triumph again. >smile<

You're trying to delete the GPO "{6AC1786C-016F-11D2-945F-00C04fB984F9}". That GPO is the "Default Domain Controllers Policy". It might have been renamed, but that GUID is always assigned to that GPO during DCPROMO and never changes.

AD is "unwilling" to delete that GPO because Microsoft designed it that way.

My advice is to return that GPO to "stock" settings, rename it back to "Default Domain Controllers Policy", see that it's linked only to the "Domain Controllers" OU, and leave it alone.

You can use the DCGPOFIX.EXE utility (see http://technet.microsoft.com/en-us/library/cc736813(WS.10).aspx) to return the "Default Domain Policy" and "Default Domain Controllers Policy" back to their default settings. If you do decide to do that, be sure you save a copy of the settings report from the GPOs as they sit before you run DCGPOFIX so that you can create addt'l GPOs with your customizations in them.

In general, I highly recommend not making any modifications in these two default GPOs. If you don't modify them, and all else fails, you can always disable all your other GPOs and get "stock" behaviour for troubleshooting. (Can't say I've ever needed that, but it's nice to know it's there...) You can modify the default GPOs, but I recommend just creating addt'l GPOs with the customizations you need and assigning their priority appropriately.

Comments

[GregD]

Is this throwing anything into the eventviewer? If so, what?

[Spence]

I'm sure we can come up with an answer. I've seen the "unwilling" error in several instances with Active Directory. You're doing something that "breaks the rules", as it were. When you say "revemo the old group policy", what do you mean? You're unlinking a specific GPO? Deleting a GPO? Be a little more specific about what you're doing and we'll figure out what's going on.

[Jason B Shrout]

When I say removing, I am performing a delete on the GPO. It is already unassociated with any users/workstations in any domain... Just can't delete it.

[Spence]

So, you're just using "Group Policy Management" console, and you've highlighted a GPO under the "Group Policy Objects" node beneath your domain and you're trying to right-click and "Delete" it? Out of curiosity, could you post the GUID from the GPO (can be gotten by opening the GPO to edit, right-clicking the top-level node in the group policy editor window, and highlighting the "Unique id" text). I have a thought...

[Jason B Shrout]

The delete portion is exactly correct. Created 10/30/2005 10:42:54 The ID or 'Unique name': {6AC1786C-016F-11D2-945F-00C04fB984F9}

[Jason B Shrout]

Good stuff and you are right. After doing some research it is the default domain controller policy. Thanks!

[l0c0b0x]

Very interesting! Evan, you are 'the one'

[Spence]

It's called "too much practice". smile I'm really getting into this Server Fault thing. I've never played an MMORPG, but I get the feeling that it kinda feels like this.

[austinian]

When you copy a policy, it inherits the permissions of the original policy, like copying a file or a policy that you create and change the permissions of. This isn't poor design, it's just a poor understanding of the behavior of the copy function.