Bizarre "Access Denied" when changing Admin Template settings

[bjsmithco]

I am really struggling with a bizarre issue that I hope folks smarter than me can comment on.

I have a set of GPOs developed in a lab environment with W2K DC, 2003 GMPC, and XP clients. The GPOs have been backed up and are then deployed to numerous global sites which have a similar, but separate, domain. We have been placing the GPO backup in an on-site repository, and having the site admin create new GPO's then import the appropriate GPO backup settings. This has appeared to work like a charm until recently when one of the site admins tried to modify a setting under the "Administrative Templates" sections. The change in setting generates a pop-up window titled "Administrative Templates" with the text "The Group Policy snapin was unable to save your changes due to the following error: Access is denied." The policy appears to take, but in fact if the GPO editor is closed and reopened, the policy was not changed. There is nothing generated in any of the event logs.

This issue only affects GPO's with imported settings. All settings in the GPO can be fully managed...just not in the Administrative Templates sections. I have recreated this scenario in my dev lab and am at a loss as to what is going on. I have checked the share and NTFS permissions on the GPO, the applicable registry areas, the SYSVOL, the .adm files, etc. and everything shows that my domain admin account has full access. I have also tested this with a Win2003 DC and have encountered the same result.

This is a butt-kicking issue that I need to resolve quickly. I'm assuming that the issue is with the previously built GPOs but I am unsure of where to start. In the meantime, I am rebuilding each of the GPOs by hand and hope that will fix it.

Any input, guidance, etc., would be very greatly appreciated.

[drbayer]

Have you verified the permissions on the Delegation tab in gpmc? There may be a special setting in there somewhere preventing access to certain aspects of the GPO.

[bjsmithco]

The permissions on the Delegation tab appear to be correct. The only policies that are affected are those that have been imported. If I create a new policy, I have full access to all Administrative Settings.

[Frankv]

Hi,

Are you using McAfee?

Please take a look at
http://social.technet.microsoft.com/...-efb3e7ddf6d9/

Also don't underestimate the ownership of files, in this case for the local templates and the templates stored in SYSVOL.

Or maybe you can try this hint at the site of Mark.
http://minasi.com/forum/topic.asp?TOPIC_ID=7378

Good luck,

[Frankv]

More hints,

Since you are importing and exporting GPO's from different domains...
http://quomon.com/question-Access-De...GPOs-4402.aspx

Are you asked to use a migration table whilst importing and exporting the GPOs ?
If so, are you mapping the correct security principals?

[bjsmithco]

In my dev environment, there is no antivirus installed. Given the problem exists in production and in my lab, I am assuming that antivirus is not the issue. I'm at a loss.