Workaround
Make sure the scope of your gPLink protection template is set to "This object only" on the OU and the operations should be set to "Modify attributes".
Using the "Create" operation will block any attempt at creating a new object in the OU container, which would block the promotion of a new Domain Controller
© ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center