Failed to open the Group Policy Object. You may not have appropriate rights.

  • Document ID:7005685
  • Creation Date:06-Apr-2010
  • Modified Date:27-Apr-2012
    • Micro Focus Products:
      eDirectory
      Open Enterprise Server

Environment

Novell Open Enterprise Server 2 SP2 (OES 2SP2) Linux
Novell Open Enterprise Server 2 SP3 (OES 2SP3) Linux
Domain Services for Windows
DSFW

Situation

Two or more domain controllers in the domain..

When editing a GPO the following error is returned:

"Group Policy Error

Failed to open the Group Policy Object. You may not have appropriate rights.

Details: The system cannot Find the path specified"

Resolution

  1. Map a drive to the sysvol and specify the domain.  Do not specify the server when mapping the drive.  Below is an example of mapping a drive to a domain called novell.com:
    \\novell.com\sysvol
  2. Right click on the domain folder. In this example it would be novell.com.
  3. Select the DFS tab.
  4. Select PDC and set as active.
    To check which server is the PDC start MMC with the Active Directory Users and Computers.
    • Right click on the domain.
    • Click Operations Masters
    • All three tabs (RID, PDC, Infrastructure) should show the same server as the Operations Master. This is the DC that should be marked active.
  5. Check the status after setting it as active.
  6. Verify the smb.conf has the unix extensions = no in the global section and wide links = yes in the sysvol section (sysvol-msdfs for ADCs). Look TID 7005705 for more information.
 The second option is to create a new link on the ADC servers.  The FRD (PDC) does not need to be modified.
  1. Remove the existing link more information. In this example the domain name will be novell.com, the frd server is s1, the adc server is s2
    cd /var/opt/novell/xad/msdfs/
    mv novell.com /tmp/
  2. Create a new link with frd server listed first then the adc second (again this is on the ADC server)
    ln -sf "msdfs:s1.novell.com\sysvol\novell.com,s2.novell.com\sysvol-msdfs\novell.com" novell.com
  3. Change the ownership of the new link
    chown -R 'Administrator'.'domain admins' novell.com
However the downside of the second option is that every connection made to the sysvol share on the ADC server will be redirected to the FRD server which might cause load related issues for the FRD, therefore this option is only recommended in smaller environments.