Return
-
Title
ChangeAuditor for Active Directory protects the Default Domain Controller Policy and Default Doma -
Description
If object protection is set up to protect either the Default Domain Controller Policy or the Default Domain Policy on either a root domain or any child domain, all GPO's (with the same name and GUID) will be locked for every child domain and / or root domain.
-
Cause
Since we use the GUID of a GPO for protection, this is a problem with these two policies (Default Domain Controller Policy and Default Domain Policy) since they always get created with the same GUID.
-
Resolution
Defect ID: TF00186348 has been logged against this issue.
WORKAROUND
- Unfortunately, the only workaround is to re-create both of the Domain Controller and Default Domain Policies of a given child domain as to have them get new GUID's (since they always get created with the same GUID when first creating a new domain). There is no ETA on the Defect ID and even when it is fixed, it will only be a cosmetic fix, that is, we will only warn that the common GUID's match when protecting either one of these two GPO's.
STATUS
- This is still outstanding as of ChangeAuditor version 5.6.89
-
Defect ID
TF00186348