-
Title
Approval Requests Are Sent To Enterprise Admins Group Even If Another Group Was Set For Approvals. -
Description
New GPOs require 'Enterprise Admins' group approval. Regardless of 'Version Control Root' or 'Container' approval settings. After the new GPO is approved by an Enterprise Admin and deployed, the GPO will then go through the configured Approval workflow the next time it is modified. -
Cause
By default, Enterprise Admins AD group is set so that GPOAdmin sends approval to this group in Version Control Root. If you create new containers they will inherit this approval setting from version control root. -
Resolution
If you change or add a user or group in the approval tab of a new or existing container under Version Control Root, make sure to remove Enterprise Admins group from Create, Modify, and Delete actions. If you remove Enterprise Admins from Modify action, but forget to remove it from the other actions, then still approval notifications are going to be sent to Enterprise Admins group.
Figure # 1 shows only a user as approver for Modify Actions:
Figure # 2 shows that still Enterprise Admins is under Create action, even though it was previously removed from Modify action:
For the notifications to be sent to the right group or user, make sure to add the right user or group under Create, Modify, and Delete actions and remove the user or group that no longer will receive approval notifications from all 3 actions.