Exception has been thrown by the target of an invocation error when copying a GPO from one domain or forest to another one. (4375943)

Exception has been thrown by the target of an invocation error when copying a GPO from one domain or forest to another one.

The following error occurs when trying to copy a GPO from one domain or forest to another one:




The issue appears to happen when there is security filtering put onto policies in a trusted forest.

When the security filtering contains objects in another forest, you can no longer copy GPOs from one forest to another. It looks like the copy works correctly, but the GPO never shows up via GPMC. If you try to change the security filter on a GPO that has current filtering in place that consist of user/computer objects in the trusted forest, the GPOADmin GUI crashes but there doesn't seen to be anything logged related to the crash or error "Exception has been thrown by the target of an invocation".
 

We have done testing in a cross forest with bi-directional trust environment and have run into issues around editing GPOs and security on the GPOs. Based on our testing we would strongly recommend having two GPOADmin servers, one per forest, and using synchronization with security mapping tables as the best practice to have a stable reliable environment.