Sounds like the permissions on the Group Policy files are wrong. Navigate to
C:\Windows\System32 and open the properties of the (hidden)
GroupPolicy folder. Go to the Security tab. The correct permissions are Full control for Administrators and
SYSTEM; Authenticated Users should have Read & execute, List folder contents, and Read. If the ACLs aren't right, open the advanced security settings and click Change permissions. Adjust the permission entries appropriately, check Replace all child object permission entries with inheritable permission entries from this object, and click OK.
If that doesn't help, you'll need to look at the security on
GroupPolicyUsers. That folder has the same settings on the folder itself, but do not replace all child object permissions! It has (hidden) subfolders, each named with the SID of the user it applies to. On each user policy folder, Administrators and
SYSTEM must have Full control, but the user (not Authenticated Users) should have Read & execute, List folder contents, and Read. Those permissions should be inherited by the children of the per-user folders.
Finally, if none of that helps, check the permissions on
C:\Windows\PolicyDefinitions. They should be the following:
TrustedInstaller has Full control on the folder and subfolders (not files)
SYSTEM has Modify on the folder itself, but Full control on subfolders and files
- Administrators have Modify on the folder itself, but Full control on subfolders and files
- Users have Read & execute, on the folder and everything in it
CREATOR OWNER has Full control on subfolders and files only
ALL APPLICATION PACKAGES have Read & execute on the folder and everything in it