Microsoft KB Archive/233548

= Organizational Unit Controller Cannot Edit Group Policy Objects =

Article ID: 233548

Article Last Modified on 2/23/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows 2000 Datacenter Server

-



This article was previously published under Q233548



SYMPTOMS
After you assign complete control of an Organizational Unit (OU) to a user or group using the Active Directory Users And Computers snap-in for Microsoft Management Console (MMC), that user or group may not be able to edit or create Group Policy objects.

NOTE: The user or members of the group can create a new computer, user, group, and printer object in the container.



CAUSE
This issue occurs because the user or group that has control of the OU is not a member of the Group Policy Creator Owners security group.



RESOLUTION
To resolve this issue, add the user or group to the Group Policy Creator Owners security group. To do this, follow these steps:

NOTE: The computer needs to be a Domain Controller to have Active Directory installed and Active Directory utilities available for these steps.
 * 1) Open the Active Directory Users And Computers snap-in using the MMC tool.
 * 2) Click to expand the Domain's Directory structure, and then click Users OU to open and view domain users and groups.
 * 3) Double-click Group Policy Creator Owners
 * 4) On the Members tab, click Add, and then click to add the user or group you want.
 * 5) Click OK.

For More information about delegation of Group Policy control, please see the following article in the Microsoft Knowledge Base:

221577 How to Delegate Authority for Editing a Group Policy Object

For More information about creating customer MMC snap-ins if Active Directory Users And Computers is not listed in the Administrative Tools of the Domain Controller, please see the following article in the Microsoft Knowledge Base:

230263 How to Create Custom MMC Snap-in Tools



STATUS
This behavior is by design.

Additional query words: GPEDIT DCW

Keywords: kbenv kbnetwork kbprb KB233548

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.