I have a Windows 2003 R2 Domain Controller with Windows 7 Clients. I copied the Policy Definitions from the Windows 7 client onto the Domain Controller's central store and into the directory "\\DOMAIN\SYSVOL\DOMAIN.local\Policies\Policy Definitions" on the server.

I logged into the client as the domain administrator and I installed RSAT for Windows 7 on the client and started it up. I created an OU and attached a GPO to the OU. I added a test user into the GPO.

I ran "gpupdate /force" on the server and then logged in on the client as the test User.

The test user was able to login, but when I ran rsop.msc, I get the error message:

Group Policy Error
The RSoP snap-in was unable to generate the computers's data due to insufficient permissions. The snap-in will continue to start but only the user's data will be displayed.

On RSOP the Action/Permission shows:

Mode: Logging
User name: DOMAIN\testuser
Display user Policy Settings: Yes
Computer name: DOMAIN\MACH3-PC (Access Denied)
Display computer policy settings: Yes

I'm new to Group Policies and how to set them up. Can anyone give me a hint about why the machine is getting "access denied"?