Return
-
Title
Cannot log in to GPOADmin - The specified directory service attribute or value does not exist. -
Description
Only the Domain Admins and Enterprise Admins groups can seem to log in to the GPOADmin client.
Even the service account, using a minimum permissions configuration cannot log in.
Users will get the error:
"The specified directory service attribute or value does not exist" -
Cause
The .NET API we use to get currently logged on user information requires read access on the default "Computers" and "Users" containers in AD.
.NET Function used:https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement.userprincipal.current?view=dotnet-plat-ext-6.0Run these commands in PowerShell, as the user attempting to log in, to verify this is the issue:> Add-Type -AssemblyName System.DirectoryServices.AccountManagement> [System.DirectoryServices.AccountManagement.UserPrincipal]::Current
This should return the exact same error text as you see when attempting to log in to GPOADmin. -
Resolution
Make sure that any user who needs to log in to GPOADmin has at least "Read" permissions on the following items in Active Directory:
CN=UsersCN=Computers
If using non-default containers, then the users need to have access to those containers instead.