GPMC Error

[mikewthom]

When I try to edit a group policy object on my computer I get: "Failed to open the group policy object. You may not have appropriate rights. Details: The parameter is incorrect." I get this when try it on my XP (SP3) whether I am domain administrator or myself.

However, if I log onto the DC as myself or Domain Administrator I can edit the policies. I get no other errors or messages in event log or anywhere else (that I know of). This has worked as soon as last week on my PC. Where do I start troubleshooting this? All of the KB articles relate to server problems. Any ideas would be appreciated.

[JerryC]

Mike,
You may be exceeding your MaxTokenSize value, the default (12 KB) size (membership in the number of groups, etc.). If so, then I'd recommend updating it to it's maximum value:
= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Lsa\Kerberos\Parameters]
"MaxTokenSize"=dword:0000ffff
= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
I see issues with this in many areas... Unable to chnage your password, unable to access certain drive mappings, unable to use the GPMC and AD U&C consoles in all domains 'except' my home domain.)

Jerry

References
==========
How to use Group Policy to add the MaxTokenSize registry entry to multiple computers
http://support.microsoft.com/kb/938118

New resolution for problems with Kerberos authentication when users belong to many groups
http://support.microsoft.com/kb/327825

[mikewthom]

Jerry,
Thanks for you advice, unfortunately it did not fix the problem. It is definitely something related to my PC, I'm just not sure what. Thanks again.

Mike

[mikewthom]

One last thought on this, I can add and delete group policies from my PC, just not edit them. For instance, I created a Test policy but could not edit it, got the error above. I could then go back in and delete it. Any ideas?

Mike

[guidopucciarello]

Hi Mike,
are you using gpmc? if you are, are you able to see the settingsfor each GPO? are you able to edit?

[mikewthom]

I came across the answer to my issue by accident while looking for something else on the internet. It was a registry issue. I went to HKEY_CLASSES_Root\MSCFILE\Shell\Open\Command registry key and set it to read %SystemRoot%\system32\mmc.exe "%1" %* (must be a REG_Expand_SZ file). After that things have worked fine. Thanks for all the suggestions.

[Mike.Stephens]

This occurs when the association for .msc files is changed. Such as using Windows Explorer to manually associate .msc files with mmc.exe. Normally, when you have problems with GPMC and GPEDIT, you can enable debug logging for just these components and then start from there. The debug logging for these two components is identified in the following blog post.

Ask the Directory Services Team : Directory Services Debug Logging Primer