I have a domain controller I am checking our security settings on. I have 2 User Rights Assignments coming up with a problem. The Default Domain Controller Policy is set to enforce that Administrators are the only group in Add computer to the domain and Restore Files From Backup.

Now the RSOP shows the setting as what it should be but has the Red X on it. So it is possible it was not set.

When I check our security took it shows it is set ONLY on this domain controller that Administrators & Server Operators are set to both user assignments. Checking where that is set shows that the local security policy on the Domain Controller is set to Administrators & Server Operators.

I removed the permissions from the Default Domain Controller Policy and put it another GPO and after gpupdate the DC shows the setting not set in RSOP. So I set it back in just Default Domain Controller Policy and it again says it doesn't apply.

Is there anything i can check to get these 2 user rights assignments to only be set to Administrators?

  • Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. – Ramhound Mar 30 '18 at 1:44

After looking at the GPOs and using the gpofix utility built into A/D I was able to fix the problem. Previously I ran gpofix target:DC and the command box hung for about 15 minutes. Normally this process would only take a few seconds. I reran the command and applied my changes to the GPO and now the setting takes effect.

It seemed that when the process hung the first time there must have been some stale code or setting not set to apply for the change of those 2 settings. After rerunning the code I can now edit and apply correctly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.