The stub received bad data error when editing a GPO. (4372827)

The stub received bad data error when editing a GPO.

The following error is seen when trying to edit a group policy:

 

The above is seen when RDP to the GPOADmin server and login to GPOADmin console using a different credentials.

 

But, when RDP to the GPOADmin server and login to GPOADmin console using the same credentials, then the error does not occur.

 

When editing a group policy, GPOADmin launches Microsoft Group Policy Management Editor (GPME).

If the editor does not launch, then this could be lack of permissions, or something in the environment preventing the user to launch GPME.
 

Confirm that the affected user is set under Version Control Container | Security with the correct role. If you RDP with one credentials and then use a different credential to connect to the GPOADmin console, then make sure that both users or credentials are set correctly under Container | Security.

 

If issue still persist after trying the above, then we need to rule out issue launching the GPME editor from GPOADmin server in your environment by trying the following steps:

1) Log into the console machine where the issue is occurring as a user seeing the issue.

2) Open GPOADmin, and check out a GPO that is experiencing this issue. Leave the GPO in a checked out state for now. Open the properties of the GPO and note the Live ID. You will need the live GUID of the GPO from GPOADmin to locate the working copy.

 

3) Open GPMC on the same machine and locate the working copy GPO. It will be titled as [GPOADmin Working Copy] - {GPO Live GUID}. You will need to be in the standard GPMC view, not the GPMC extension to see the working copies.

4) Click on the Working Copy GPO, and select "Details" in the pane on the right. Here take note of the Unique ID of the working copy GPO.

 

5) Open ADSI Edit and find the path to the GPO. It will be in the Default Naming Context in the path: DomainFQDN/System/Policies/CN={Unique ID}

6) Once the GPO is found in ADSIEdit, open the properties on the object and locate the distinguishedName. You will need this in the next step.

 

7) Open a command prompt and execute the following command. This is the command that GPOADmin uses to launch the editor for the working copy:

mmc.exe gpme.msc /gpObject:"LDAP://<domainFQDN>/<distinguishedName>"

 

As seen in the above screenshot, this command should launch the editor and open the working copy for edit. If it does not launch, then there is something (GPO, Server Hardening, Permissions, etc..) preventing the editor to launch successfully or possible environment issue and must be fixed natively for GPOADmin to work.