Unable to delete Group Policy Object

[chie...@gmail.com]

I'm working on Windows Small Business Server 2003. This OS was
installed from an image by the OEM. I went through the "connect to
the Internet" wizard again to enable RPC over HTTP so the users can
use the Outlook client to access their email remotely. At the end of
the Technet article ( http://technet.microsoft.com/en-us/library/bb123622.aspx
) it linked to another Technet article ( http://technet.microsoft.com/en-us/library/bb124175.aspx
) on howto verify RPC is working. I tried this using Internet
Explorer and was denied access (HTTP error 401.1), which is different
from the error you should get if everything's working. I checked the
server's Application Log and found a number of entries for error #1058
and 1030 where they're looking for a Group Policy gpt.ini file. This
led me to a Microsoft KB article ( http://support.microsoft.com/kb/887303
). As I went through it I ran gpotool.exe and looked in the Sysvol
folder and found that all the Group Policies with errors were missing
the corresponding folder on the hard drive. I went into Server
Management > Advanced Management > Group Policy Management > Forest >
Domains > my domain > Group Policy Objects and selected some of the
GPOs. Some worked fine and some came back with an error unable to
find the file. As the KB article suggests I ran Dcgpofix.exe but it
didn't recreate the files for these policies. I then tried deleting
one of the GPOs that was missing the corresponding Sysvol files and
ran gpotool.exe again. That GPO was no longer listed so I had one
fewer error. I was able to delete all but two of the GPOs that lack
Sysvol files. Those two are "Small Business Server Internet
Connection Firewall" and "Small Business Server Windows Firewall."
When I try to delete them I get and "initialization failure" error.

What do I need to do to delete these GPOs?

Matthew

[Shawn Shao [MSFT]]

Hi Matthew,

Thank you for posting here.

From your post, I understand that Group Policy related problem was
encountered when setting up RPC over HTTP. Now the following two group
policies cannot be deleted from the Group Policy Management Console.
Message "initialization failure" was received.

Since other GPO can be deleted without issue, these GPO may have been
corrupted or miss-configured. Let's try the following steps to remove both
group policies from the system:

Step 1: Delete policy objects
=========
1. Click Start and then Run.
2. Type in Adsiedit.msc and press Enter.

Note: To use this tool, you may need to install Windows Server 2003 Support
Tools from the product CD or from the Microsoft Download Center:

http://www.microsoft.com/downloads/details.aspx?FamilyID=96a35011-fd83-419d-
939b-9a772ea2df90&DisplayLang=en

3. Locate Domain[<your domain name>]\DC=<your dc
name>,DC=local\CN=System\CN=Policies
4. Delete the corresponding GUID.

Note: Policy GUID can be found from Server Management\Advanced
Management\Group Policy Management, select the policy you would like to
delete, click the Detail tab in the right panel. However, if the GUID
cannot be displayed properly, we will take some time to verify GPT.INI
files one by one under the following location, it contains the policy names.

C:\Windows\SYSVOL\domain\Policies\{GUID}

Step 2: Delete policy folders
=========
Delete corresponding GUID folders from Sysvol folder

C:\Windows\SYSVOL\domain\Policies

After that, please check if these policies are still available.

If everything is working correctly now, we can reinstall the Administration
(part of server tools) in SBS integration setup to re-create SBS default
group policy objects

To do so:
=========
1. Click Start, click Control Panel, and then click Add or Remove Programs.
2. Select Windows Small Business Server 2003 and then click Change/Remove.
The Setup Wizard appears.
3. Click Next to start the wizard.
4. On the Windows Configuration page, click Next.
5. Insert the SBS 2003 CD-ROM disc three into your CD-ROM drive. On the
Component Selection page, in the Action column, change Server Tools to
Maintenance, change Administration component to Reinstall, and then click
Next.
6. On the Component Summary page, click Next.
7. Click Finish.

Note: These recreated GPOs will not be linked to the domain or OU
automatically.

If there is still problem, you can also help me collect the MPS report
from the SBS server:
---------------
a. Please download the MPSRPT_SETUPPerf.EXE from the following link and
then run this tool to gather some information from the problematic computer:
http://download.microsoft.com/download/b/b/1/bb139fcb-4aac-4fe5-a579-30b0bd9
15706/MPSRPT_SETUPPerf.EXE

b. Double-click on the MPSRPT_SETUPPerf.EXE file. [Note] This process may
take some time; however, it will not have a negative effect on the
performance.
c. A CAB file will be generated in the
%systemroot%\MPSReports\Setup\Reports\Cab directory
called%COMPUTERNAME%_MPSReports.CAB. The CAB file will contain the reports
generated by the MPS Reporting Tool.

You can send it to me as attachment to my mailbox v-sh...@microsoft.com

If anything is unclear, please feel free to post back and I will be glad to
help.

Best regards,

Shawn Shao
Microsoft CSS Online Newsgroup Support

Get Secure! - www.microsoft.com/security

=====================================================
This newsgroup only focuses on SBS technical issues. If you have issues
regarding other Microsoft products, you'd better post in the corresponding
newsgroups so that they can be resolved in an efficient and timely manner.
You can locate the newsgroup here:
http://www.microsoft.com/communities/newsgroups/en-us/default.aspx

When opening a new thread via the web interface, we recommend you check the
"Notify me of replies" box to receive e-mail notifications when there are
any updates in your thread. When responding to posts via your newsreader,
please "Reply to Group" so that others may learn and benefit from your
issue.

Microsoft engineers can only focus on one issue per thread. Although we
provide other information for your reference, we recommend you post
different incidents in different threads to keep the thread clean. In doing
so, it will ensure your issues are resolved in a timely manner.

For urgent issues, you may want to contact Microsoft CSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

Any input or comments in this thread are highly appreciated.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

[chie...@gmail.com]

Sorry for taking so long to post back. I was able to delete the Group
Policies following the steps you specified. I went as far as
recreating the GPOs but didn't link them back with the domain or OU.
However, that didn't fix my RPC problem. I'll start a new thread in
this newsgroup for that and link back to this one.

Matthew

[Shawn Shao [MSFT]]

Hi Matthew,

Thank you very much for your reply.

I am glad to hear that the information I provided was useful. For further
reference, I'd like to compose a summary here.

Issue: Delete GPO from GPMC, Message "initialization failure" was received.
Cause: GPO may have been corrupted or miss-configured.
Solution: Delete Object from Adsiedit.msc and GPO folder from SYSVOL

For future postings, I would like to list the following information as a
guideline when submitting new posts in the future. This information will
help us to understand the issue and situation more quickly. Thank you!

1. Has the server/client/product ever worked?
2. If so, what changed?
3. What service packs and updates were applied?
4. What are the steps to reproduce the problem?
5. Does it happen the same way on any other systems?
6. Please provide the exact error message with any screenshots, if possible.

Have a nice day!