GPO Changes Can Be Written to Different Domain Controllers If the User Is Not a Local Administrator

If a user creates a new Group Policy Object (GPO) and then immediately tries to open the GPO to edit it, the follow error message may occur:

This behavior can occur if the user making the changes to the GPO (to which the user has been delegated change permissions) is not a domain or enterprise administrator and is also not a member of the local Administrators group.

When you use the Group Policy snap-in, the data written to the SYSVOL portion of the GPO may not be written to the same domain controller as the data written to the Active Directory portion of the GPO.

Clients behave properly regarding this inconsistency; Active Directory and the File Replication service (FRS) take care of synchronizing the two components. However, if the user who is modifying the GPO specifies the domain controller on which to make the GPO changes, the SYSVOL data may not be present because of the reason described above. In the case of a new GPO, the user must wait for the SYSVOL data to be replicated to the domain controller that is targeted in the Group Policy snap-in before the user can edit the GPO.

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.