Article ID: 273857
Article Last Modified on 3/1/2007
APPLIES TO
- Microsoft Windows 2000 Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Professional Edition
This article was previously published under Q273857
SUMMARY
This article describes how to give users permission to access the Group Policy object if the Access Control List (ACL) has been modified so that Read and Apply permissions are restricted.
MORE INFORMATION
You may not be able to apply a Group Policy object if the Access Control List (ACL) has been configured to restrict Read and Apply permissions for the Group Policy object.
By default, if you are a member of the Authenticated Users group, you have access to Group Policy objects. The Authenticated Users group has Read and Apply Group Policy permissions on Group Policy objects. If the Authenticated Users group is removed from the ACL on the Group Policy object, then you do not have Read and Apply permissions for that Group Policy object.
As an administrator, you can give users access to the Group Policy object by using either of the following methods:
- Add the user to the ACL on the Group Policy object explicitly, and then give this user Read and Apply Group Policy permissions.
- Give the Authenticated Users group Read and Apply Group Policy permissions.
- Create a security group, add the necessary users to this group, and then give this group Read and Apply Group Policy permissions on the ACL of the Group Policy object.
NOTE: You must also ensure that the user, or the group that the user belongs to, is not explicitly denied access to the Group Policy object. An explicit Deny permission always overrides an Allow permission.
For additional information, click the article numbers below to view the articles in the Microsoft Knowledge Base:
250842 Troubleshooting Group Policy Application Problems
201227 Managing Security on Group Policy Data in SYSVOL
Keywords: kbacl kbgpo kbhowto KB273857
