Error adjusting Group Policies

[Caveman]

Hello,

When I try to change the Default Domain Policy or any other policy in
Windows 2003 SBS Standard, I get this error:

"The Group Policy snapin was unable to save your changes due to the
following error:
The process cannot access the file because it is being used by another
process."

I've tried everything I can, I have all the rights in het sysvol share,
etc etc, but I don't get the error away...

Anyone who knows this error and able to help me is very welcome!

Thanks!

Greetz,
Caveman

[Steven Zhu [MSFT]]

Hi Caveman,

Thanks for posting here.

From your post, my understanding of the issue is: when you want to change
the any group policy in Windows

SBS 2003, you get the following error:

"The Group Policy snap-in was unable to save your changes due to the

following error:
The process cannot access the file because it is being used by another
process."

If I am off base, please feel free to let me know.

Based on my research, the particular error is most likely caused by there
is other process tries to access the

SYSVOL folder when you change the group policy. So please provide the
following details to help me narrow

down this issue:

1. Please confirm whether you have any Anti-Virus software is scanning the
SYSVOL folder.

2. Please create the new GPO and change it, does the issue disappear?

3. Please download the FILEMON tool and place it on the Target DC on the
server:

1.) Please refer to the following web link to download this tool:

http://www.sysinternals.com/ntw2k/source/filemon.shtml

2.) Open FILEMON from the target DC (it will instantly start capturing
logs).

3.) Reproduce the error by trying to modify and save the policy changes.

4.) Stop the capture (with the magnifying glass icon) (the shorter the
capture the better)

5.) Save the captured log and send the captures to my work address:
v-st...@microsoft.com.

Note: The third-party product discussed is manufactured by a vendor
independent of Microsoft; we make no

warranty, implied or otherwise, regarding this product's performance or
reliability.

Please let me know the result above so that I can provide the further
assistance on the problem. I am looking

forward to your reply.

Have a nice day.

Best Regards,

Steven Zhu
MCSE
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
======================================================
PLEASE NOTE the newsgroup SECURE CODE and PASSWORD were
updated on February 14, 2006.? Please complete a re-registration process
by entering the secure code mmpng06 when prompted. Once you have
entered the secure code mmpng06, you will be able to update your profile
and access the partner newsgroups.
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
======================================================

[Sven Holman]

Hi Steven,

You understand the question right.

Even if I try to add a new policy the message appears on my screen... I will
try to install Filemon and send the data to you..

Do you know if there's an option to set the Default Domain Policy back to
the defaults? I don't know if that's the problem, but I could try it...
Nothings works at the moment, my users can't work, because I need to disable
the Windows Firewall, but I can't change the policies..:(

You will get an email from me soon!

Thanks anyway!

"Steven Zhu [MSFT]" schreef:

[Steven Zhu [MSFT]]

Hi,

Thanks for taking time to respond.

From your reply, I know you want to restore the Default Domain Policy back
to default. If I am off base, please feel free to let me know.

Based on my research, you can refer to the following knowledge base article
to reset the Default Domain Policy back to default:

How To Reset User Rights in the Default Domain Group Policy in Windows
Server 2003
http://support.microsoft.com/kb/324800/en-us

I hope the above information helps.

[Sven Holman]

Hi Steven!

Thanks for your support!
Your suggestion about setting the policies back to default brought no
solution... I wasn't able to save the files, due to the reason that notepad
give me the error that the file wasn't at the right place and that Notepad
was unable to save...

The problem is still there... Do you have any other suggestions?

Thanks for your time!

Greetz,
Sven Holman a.k.a. Caveman

"Steven Zhu [MSFT]" schreef:

[Paul Fitzgerald [MSFT]]

The error you mention is still kind of unusual. Do you have the GPOs open in
another local or TS session?

But you should never change those policies. Just create a new one for new
settings and if you really want to change a setting in either of the default
policies then you should still create a new one and set a higher precedence
order. From a debugging standpoint you really want to keep this separation.

I would run this. %windir%\system32\dcgpofix.exe . It will reset the
default domain and default domain controller policies. If you have settings
in those policies that you have alread changed you will loose them.

Prior to running dcgpofix you should run a backup. Right click on the node
called group policy objects and include backup all. This takes a minute or
so and takes up very little room.

[Steven Zhu [MSFT]]

Hi,

Thank you for your prompt response. From your reply I understand that you
cannot save the files. By default, the GPTTmpl.inf file locates
\\<server_name>\Sysvol\DomainName\Policies\{31B2F340-016D-11D2-945F-00C04FB9
84F9}\Machine\Microsoft\Windows NT\SecEdit. You can use Notepad.exe
program open this file and refer the knowledge base article I provide
modify the GPTTmpl.inf file. Also, you can use the same method to modify
the GPT.ini file locate
\\<server_name>\Sysvol\DomainName\Policies\{31B2F340-016D-11D2-945F-00C04FB9
84F9}.

I doing some test about the steps in the Knowledge base article I provide
in previous post on my test system, it's no problem. So please reconfirm
the steps in the following knowledge base article:

How to Reset User Rights in the Default Domain Group Policy in Windows
Server 2003
http://support.microsoft.com/kb/324800/en-us

I agree the Paul's suggestion. Also you can use the Dcgpofix.exe program to
restores the default Group Policy objects to their original state. For more
information, please refer the following technology article:

http://technet2.microsoft.com/WindowsServer/en/Library/48872034-1907-4149-b6
aa-9788d38209d21033.mspx

If the issue persists, please send the error message screenshot to my work
address: v-st...@microsoft.com. I can provide further assistance on this

problem. I am looking forward to your reply.

Have a nice day.

[SrChasJC]

Was there a fix to all this? I am getting the same error, and I've noticed
several other posts about it as well. Thanks in advance.. SrChasJC

[Steven Zhu [MSFT]]

Hi,

Thanks for posting here.

Based on current information, your error seems same with the Caveman's
error message, but the GPO cannot be saved may caused by multi root issue.
So I suggest you re-create a new thread in our newsgroup, and please
provide more details in the new post. It's always our pleasure to be of
assistance.

Thank you for your patience and understanding.

Have a great day.