ChangeAuditor for Active Directory protects the Default Domain Controller Policy and Default Doma (86775)

If object protection is set up to protect either the Default Domain Controller Policy or the Default Domain Policy on either a root domain or any child domain, all GPO's (with the same name and GUID) will be locked for every child domain and / or root domain.

Since we use the GUID of a GPO for protection, this is a problem with these two policies (Default Domain Controller Policy and Default Domain Policy) since they always get created with the same GUID.

Defect ID: TF00186348 has been logged against this issue.

WORKAROUND

• Unfortunately, the only workaround is to re-create both of the Domain Controller and Default Domain Policies of a given child domain as to have them get new GUID's (since they always get created with the same GUID when first creating a new domain). There is no ETA on the Defect ID and even when it is fixed, it will only be a cosmetic fix, that is, we will only warn that the common GUID's match when protecting either one of these two GPO's.

STATUS

• This is still outstanding as of ChangeAuditor version 5.6.89