返回
-
标题
Protected Group Policy replication issues with ChangeAuditor Group Policy Protection enabled -
说明
In some circumstances, a Group Policy Object (GPO) may fail to replicate to all Domain Controllers if Change Auditor Group Policy Protection is enabled on the object. -
原因
The NT AUTHORITY\SYSTEM account is Protected from updating the Group Policy.
Some changes were carried out on AD object.
-
解决办法
WORKAROUND
Temporarily disable Protection on the Group policy object to allow for GPO replication.
RESOLUTION
Add NT AUTHORITY\SYSTEM as an excluded account prior to the GPO Protection Template:- Edit the Protection template and click "Next" in the wizard until the "Select Accounts allowed to access protected objects" page is displayed
- In the object picker, collapse the "Domain" node, and the "Configuration" node will be visible underneath
- Select Configuration | WellKnown Security Principals | SYSTEM
- Click Add
- Click Finish
Allow 15 minutes for the new Change Auditor agent configurations to refresh.