Error message when a domain administrator or a local administrator uses the GPResult.exe tool or runs an RSoP query in Windows Server 2003: “Access denied”

Applies to: Microsoft Windows Server 2003 Standard Edition (32-bit x86)

Symptoms


Consider the following scenario:
  • You are logged on to a Microsoft Windows Server 2003 Standard Edition-based computer as a domain administrator or as a local administrator.
  • You run the Group Policy Results (GPResult.exe) command line tool.
  • You have several Windows Server 2003 member servers that share the same organizational unit (OU).
In this scenario, you may receive an “Access denied” error message on most of the computers on which GPResult is run.

When you perform a Resultant Set of Policy (RSoP) query, you may receive an error message that resembles the following:
The Rsop snap-in was unable to generate the Rsop data due to the error listed below.
Access is denied.

Resolution


This symptom can be caused by incorrect permissions for the RSOP namespace in WMI or insufficient permissions at the NTFS level for the user acccount initiating the GPRESULT command.


- To confirm if the user account has sufficient permissions at the NTFS level, the administrator can run the Procmon.exe tool from Sysinternals (http://technet.microsoft.com/en-en/sysinternals/bb896645) while the GPRESULT command is issued.
Monitor for any 'Access Denied' error messages being logged by Procmon while the administrator issues the GPRESULT command and use these to identify if the NTFS permissions are insufficient to complete the GPRESULT operation.

- Verify that the default permissions for the RSoP namespace are correct by using the WMI Control Microsoft Management Console (MMC) snap in.For more information about WMI namespaces security, click the following article number to view the article in the Microsoft Knowledge Base:

325353 How to set WMI namespace security in Windows Server 2003

  1. If problems persist, troubleshoot the WMI service further. For more information about how to do this, visit the following Microsoft Web site: