Policies Stuck in "Pending Deployment" with Access Denied (0x80070005) (4383826)

Customers may observe that GPOs become stuck in "Pending Deployment" status with the "Pending Action" set to "Edit" in GPOADmin.

Attempts to deploy the policies fail, even after following standard troubleshooting steps.

Error Messages

• Error importing settings to object. Access is denied. (HRESULT: 0x80070005 (E_ACCESSDENIED))
• Access is denied. (HRESULT: 0x80070005 (E_ACCESSDENIED))

This issue is typically caused by an access denied condition on the SYSVOL files, most commonly involving the GPE.INI file associated with the affected GPO.

In this case, the root cause was:

• The GPE.INI file was set to Read-Only
• The parent Policies folder in SYSVOL also had the Read-Only attribute enabled, preventing GPOADmin from modifying policy data during deployment

Step-by-Step Checks

Perform the following validations:

1. Permissions & Delegation

   • Ensure the GPOADmin service account has:
     • Edit settings
     • Delete
     • Modify security
   • Verify via:
     • GPMC → GPO → Delegation tab
   • Re-add permissions if necessary to ensure proper inheritance

2. GPO Ownership

   • Confirm the service account is the owner of the GPO

3. SYSVOL Permissions

   • Validate access to:

     \\<domain>\SYSVOL\<domain>\Policies\{GPO-GUID}
     

   • Ensure the account has sufficient NTFS permissions

4. Check GPE.INI File

   • Verify the file is not set to Read-Only
   • Location:

     \\<domain>\SYSVOL\<domain>\Policies\{GPO-GUID}\gpt.ini
     

5. File Locks

   • Ensure the file is not locked by another process

6. SYSVOL Structure

   • Check for legacy NTFRS folders that may interfere with access