ProcessGPOs: User name is: UserOrComputerDN , Domain name is: DomainNameNote In these entries, OUName is the parent organizational unit (OU) of the user account or of a computer object.
ProcessGPOs: Domain controller is: \\ DC FQDN Domain DN is DomainName
EvaluateDeferredOUs: Object OUName cannot be accessed
GetGPOInfo: EvaluateDeferredOUs failed. Exiting
- distinguishedNanme (used in the search filter)
- gPLink (requested as data)
- gPOptions (requested as data)
In Microsoft Windows 2000 Server, the events that are described in the "Symptoms" section are not logged. The Group Policy engine in Windows 2000 Server then ignores the Group Policy settings that are linked to the OU. Windows XP was changed to not ignore this error.
By default, access to all OUs is granted according to an access control entry in the default security descriptor. This security descriptor is part of the schema that enables the Authenticated Users group to read all the properties.
Granting poermissions on the "distinguishedName" attribute through ACL Editor requires you to change the attribute visibility in DSSEC.DAT in the "[organizationalUnit]" section. You need to change the line "distinguishedname=7" to "distinguishedname=0".
When you then restart the application showing ACL Editor, the attribute should be visible.
מזהה פריט: 909260 - סקירה אחרונה: 29 במרץ 2017 - תיקון: 3