I have a Windows Server 2003 SP1 that was upgraded from Windows 2000. Anytime I try to run gpresult or rsop.msc I get "ERROR: Access Denied" in return after it sits at "Getting the domain information..." then the OS information and RSOP line quickly flash by before the ERROR message appears.
I have tried running the commands as an administrator, specifically disabling the policy "Disallow Interactive Users from generating Resultant Set of Policies" in both the user and computer sections. I also removed the computer from the domain and re-added it.
I did check the OU and domain admins have the ability to "Generate Resultant Set of Policy" at that OU. All other computers in that OU can run gpresult without a problem.
I was able to get gpresult to run on the problem server if I copy the gpresult.exe from a Windows 2000 server. However, if I copy gpresult.exe from a Windows 2003 server it still results in "ERROR: Access Denied"
Running Group Policy Results from GPMC on another server will work if I don't run the computer settings and select a local user instead of a domain user.
> I was able to get gpresult to run on the problem server if I copy the gpresult.exe from a Windows 2000 server. However, if I copy gpresult.exe from a Windows 2003 server it still results in "ERROR: Access Denied"
Good one. So this is a software problem. I'd reinstall the server. Who knows what is broken by now.
Make it as simple as you can, but not simpler -- Albert Einstein
It is an older development server so it is not the end of the world that gpresult and rsop.msc fail. I guess I will just deal with it. I can't really think of anything else to try besides reinstalling a service pack or the whole OS.
gpresult.exe from Win2K is an entirely different animal, so I'm not surprised it would work. But that's not a true test because it doesn't use RSOP to gather its data. I still think there is a permissions issue. Is that right you have on the OU set to apply to the OU and all child objects or just the OU level?
Here is what I have done for permissions on the OU that contains the server with the gpresult error:
Right-clicked the OU > Properties > Security tab Clicked Add > %myusername% Clicked Advanced. Highlighted my username and clicked Edit. Set Apply Onto to: This object and all child objects Clicked Allow Full Control. Clicked OK x 3.
I did the same thing with the computer object.
I then logged back on to the server and there was no change. Still "ERROR: Access Denied"
This is a recent OU that I created with default permissions so I don't think anything out of the ordinary is happening with it.
I rebooted the server and did not see anything interesting in the Event Viewer. I gave myself all the permissions on the COM security tab anyway and it did not help.
Then I thought that it might be WMI corruption. I checked the wbemess.log and it had a few errors. One was 0x80041033. I looked at this web page http://forums.winforums.org/showthread.php?t=8677 and deleted the wbem repository and ran this script: %SYSTEMDRIVE% CD %windir%\system32\wbem Mofcomp.exe cimwin32.mof Regsvr32 /s wbemupgd.dll Regsvr32 /s wbemsvc.dll wmiprvse /regserver