-
Title
Unable to check group policy back in after an ADPrep operation in Active Directory -
Description
Performing an ADPrep caused GPO's to become labeled as "Noncompliant - UnAuthorized modifications" and performing the Undo Check Out produces an error "Value cannot be Null"
-
Cause
GPOs can become Noncompliant when any modifications are made outside of the product, such as ADPrep. ADPrep will update GPO versions to the new AD schema version, therefore alarming GPOADmin that a modification has been made. This is checked via the Watch Service and within GPOADmin itself.Please note that there is no way to prevent this behavior. -
Resolution
Workaround
-
On any GPOs that are marked as 'Noncompliant - Unauthorized Modifications' you can run a 'Compliance Check', or a 'Difference Report' to verify that no inappropriate modifications have been done. If these come back clean this indicates the Watcher Service noticed a potential change when the schema update touched the GPOs.
If this is the case you can go into the UI under the version control root and select 'Incorporate Live' to merge the good live version into the version controlled version which will then reset the hash that the Watcher Service used to check for changes. After this they will be marked as compliant properly.
-