Permissions are required outside of GPOADmin for objects with disabled workflow (4328077)

Workflow-disabled objects in GPOADmin can be quickly edited without the need for approval. This is often used in combination with test GPOs.

When working with workflow-disabled objects in GPOADmin, it is important to note that users would need the appropriate rights inside the live environment outside of GPOADmin in order to i.e. edit GPOs.

Workflow-disabled objects are not managed by GPOADmin and do not run with the workflow process under the GPOADmin service account context.