Can’t Create GPO This security ID may not be assigned as the owner of this object.

[bethk]

#167025

Hi,

I am unable to create a new GPO in my Domain 2012 R2 DC. I created many of the GPOs that are in the domain currently but recently I am getting:

This security ID may not be assigned as the owner of this object.

When trying to add a new policy. Tried the GUI and also from the powershell cmd new-gpo – hoping that perhaps I would get more diagnostic information from the powershell — but same message either way.

From several sites I have read this error indicates the user doesn’t have the correct permissions for SOMETHING — but cannot figure out where it is missing.

Tried resetting permissions to default via https://technet.microsoft.com/en-us/library/cc816750(v=ws.10).aspx

C:Windowssystem32>icacls c:WindowsSYSVOL
c:WindowsSYSVOL NT AUTHORITYAuthenticated Users: (RX)
NT AUTHORITYAuthenticated Users: (OI)(CI)(IO)(GR,GE)
BUILTINServer Operators: (RX)
BUILTINServer Operators: (OI)(CI)(IO)(GR,GE)
BUILTINAdministrators: (F)
BUILTINAdministrators: (OI)(CI)(IO)(F)
NT AUTHORITYSYSTEM: (F)
NT AUTHORITYSYSTEM: (OI)(CI)(IO)(F)
BUILTINAdministrators: (F)
CREATOR OWNER: (OI)(CI)(IO)(F)

Anyone have know what I am doing wrong? Where can I look?

Really appreciate insights.

Beth

[Author]

Posts