- Remove From My Forums
-
Вопрос
-
У меня возникла проблема с групповыми политиками:
AD — Windows Server 2008 R2
Пытаюсь применить групповые политики на два терминальных сервера под управлением Windows Server 2003 R2Все сервера лицензионные. Выполнил на всех трех серверах обновления, однако результат тот же.
Создано 2 (две) GPO: Add Share (сопоставление дисков) и Folders (перенаправление папок).
Политика Folders применяется без проблем.
Политика Add Share применяется только для группы Администраторы. Для пользователей пишет следующую ошибку:Из списка событий на терминальном сервере:
Тип события: Ошибка
Источник события: Group Policy Drive Maps
Категория события: (2)
Код события: 8192
Дата: 08.08.2012
Время: 17:09:04
Пользователь: NT AUTHORITYSYSTEM
Компьютер: TS
Описание:
Элемент предпочтения пользователь «X:» в объекте групповой политики «Add Share {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}» не применен по причине ошибки с кодом «0x80070005 Отказано в доступе.» Дополнительные сведения находятся в файле трассировки.Может кто сталкивался с такой проблемой?
Уже неделю бьюсь.
Тех. поддержка отправила на портал Technet.
Ответы
-
Проблема была решена.
Проблема заключалось в том, что один их сопоставленных дисков был с правами только для локальных администраторов и пользователей, поэтому не применялся через групповые политики.
Решение: Закрыть общий доступ к сопоставляемому диску, а затем открыть по новой.
Всем спасибо за помощь в решении проблемы.
-
Помечено в качестве ответа
20 августа 2012 г. 5:00
-
Изменено
Provizor_86
20 августа 2012 г. 5:00
-
Помечено в качестве ответа
Issue
Trying to copy a file from a network share to client machines using Group Policy (Computer Configuration > Preferences > Windows Settings > Files)
Operation fails with error 0x80070005 Access is denied.
Client computer records a warning event in Application Logs:
Event ID: 4098
Source: Group Policy files
Leven: Warning
Description:
The computer ‘filename.txt’ preference item in the ‘<GP name and ID>’ Group Policy object did not apply because it failed with error code ‘0x80070005 Access is denied.’ This error was suppressed.
Cause
The issue was caused by insufficient permissions to access the source file on the network location. Although «Computer» part of Group Policy runs as a SYSTEM account, this applies to the target client computer, not the server where shared files are stored.
Resolution
Give Authenticated Users «Read-Only» access to the network share where source files are saved. Also change NTFS permissions if necessary.
Windows Server 2008
Windows 7 Pro
- Remove From My Forums
Group Policy preference not applying on server 2008R2 — Error Code 0x80070005 Access is Denied
-
Question
-
I have seen several questions that have a similar issue as I have but none of the answers I have found seem to work. I need assistance with what seems to be one of the simplest, most mundane tasks in the world with a Group Policy but I cannot figure out
what on earth is going on.Due to some issues with slow boot up times, our users had asked IT to create a GPO that would set the Microsoft Distributed Transaction Coordinator (MSDTC) to have a delayed startup time but to start automatically. We did this an all was well. However, in
recent months, the server team has decided they want to test if the slowdowns are still the same on the MSDTC for a select group of computers. I created a new group to identify the computers to test. I then created a GPO with the following settings:
(1) Computer Configuration>Policies>Administrative Templates>System/Group Policy>Use Group Policy loopback processing mode Enabled, Mode: Replace. (2) Computer Configuration>Preferences>Control Panel Settings>Services>Service (Name:MSDTC)>MSDTC
(Order:1).>Startup Type: Automatic.The GPO is linked to the particular OU where the servers they want to test are located. I set the Security Filters to Authenticated Users, Domain Computers, and the Group that I created which housed the computer names that desire this issue. I made sure
delegation is set to allow Authenticated Users to Edit, Delete and Modify as well as those permissions on the group with the comptuers. I even went to the SYSVOL folder and veriifed that the Unique ID folder was set to be editable by those parties.I launch the GPO and do a GPUpdate on three of the servers in the group and they ALL come back with the error:
«The computer ‘MSDTC’ preference item in the ‘DTC Auto Start {*******************}’ Group Policy Object did not apply because it failed with error code ‘0x80070005 Access is denied.’ This error was suppressed.»
What did I do wrong? I have redone this so many times with so many different ways that it is driving me to insanity. Any GPO Gurus offer help?
Answers
-
Dave-
In terms of loopback, since the setting you’re delivering is a per-computer setting, loopback doesn’t come into play here at all. But it won’t hurt anything because of that.As for the error itself, it sounds like the GPP setting is failing because it can’t modify the service’s configuration. Notwithstanding a problem with GPP itself, which might be surfaced through using the trace logs I mentioned, the only other plausible
explanation is that the service itself has been hardened. In any case, I would try using the System Services policy to see if it throws the same error (hopefully not).Darren
Darren Mar-Elia MS-MVP, Group Policy
www.gpoguy.com
www.sdmsoftware.com — «The Group Policy Experts»-
Marked as answer by
Monday, June 18, 2012 2:38 AM
-
Marked as answer by
-
> the original but I did not set any kind of permissions on the GPO
> screen, just left it all as default «No Change». On my test machine, I
> was
You didn’t mention that you not only configured the start mode, but also
permissions… If you kick out «SYSTEM», you cannot undo — in
particular, the GPSVC cannot modify the service anymore. It’s a little
bit like shooting yourself in your foot ;-))
regards, Martin
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I’m glad about a rating!-
Marked as answer by
Lawrence,Lu
Monday, June 18, 2012 2:38 AM
-
Marked as answer by
- Remove From My Forums
Group Policy preference not applying on server 2008R2 — Error Code 0x80070005 Access is Denied
-
Question
-
I have seen several questions that have a similar issue as I have but none of the answers I have found seem to work. I need assistance with what seems to be one of the simplest, most mundane tasks in the world with a Group Policy but I cannot figure out
what on earth is going on.Due to some issues with slow boot up times, our users had asked IT to create a GPO that would set the Microsoft Distributed Transaction Coordinator (MSDTC) to have a delayed startup time but to start automatically. We did this an all was well. However, in
recent months, the server team has decided they want to test if the slowdowns are still the same on the MSDTC for a select group of computers. I created a new group to identify the computers to test. I then created a GPO with the following settings:
(1) Computer Configuration>Policies>Administrative Templates>System/Group Policy>Use Group Policy loopback processing mode Enabled, Mode: Replace. (2) Computer Configuration>Preferences>Control Panel Settings>Services>Service (Name:MSDTC)>MSDTC
(Order:1).>Startup Type: Automatic.The GPO is linked to the particular OU where the servers they want to test are located. I set the Security Filters to Authenticated Users, Domain Computers, and the Group that I created which housed the computer names that desire this issue. I made sure
delegation is set to allow Authenticated Users to Edit, Delete and Modify as well as those permissions on the group with the comptuers. I even went to the SYSVOL folder and veriifed that the Unique ID folder was set to be editable by those parties.I launch the GPO and do a GPUpdate on three of the servers in the group and they ALL come back with the error:
«The computer ‘MSDTC’ preference item in the ‘DTC Auto Start {*******************}’ Group Policy Object did not apply because it failed with error code ‘0x80070005 Access is denied.’ This error was suppressed.»
What did I do wrong? I have redone this so many times with so many different ways that it is driving me to insanity. Any GPO Gurus offer help?
Answers
-
Dave-
In terms of loopback, since the setting you’re delivering is a per-computer setting, loopback doesn’t come into play here at all. But it won’t hurt anything because of that.As for the error itself, it sounds like the GPP setting is failing because it can’t modify the service’s configuration. Notwithstanding a problem with GPP itself, which might be surfaced through using the trace logs I mentioned, the only other plausible
explanation is that the service itself has been hardened. In any case, I would try using the System Services policy to see if it throws the same error (hopefully not).Darren
Darren Mar-Elia MS-MVP, Group Policy
www.gpoguy.com
www.sdmsoftware.com — «The Group Policy Experts»-
Marked as answer by
Monday, June 18, 2012 2:38 AM
-
Marked as answer by
-
> the original but I did not set any kind of permissions on the GPO
> screen, just left it all as default «No Change». On my test machine, I
> was
You didn’t mention that you not only configured the start mode, but also
permissions… If you kick out «SYSTEM», you cannot undo — in
particular, the GPSVC cannot modify the service anymore. It’s a little
bit like shooting yourself in your foot ;-))
regards, Martin
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I’m glad about a rating!-
Marked as answer by
Lawrence,Lu
Monday, June 18, 2012 2:38 AM
-
Marked as answer by
I am using Group Policy Preference item to copy a file from a network URL to a location within the users profile and keep coming up with an Evnit ID 4098 (as seen below). Here is what I have:
1. This is a Windows XP SP3 machine with the group policy client side extension installed
2. I have also confirmed that from that machine with the user logged in, I can access the location of the policy folder (as shown below) so it doesn’t appear to me to be a permission issue.
3. The permissions on that policy folder allows Authenticated user to read it.
3. User does not have admimistrative permissions on machine being logged into
Anyone have any idea what could be the causing this?
______
\domain.localSYSVOLdomain.localPolicies{B9EFD8C6-627D-4D72-A42B-E36357AC1490}
Event Type: Warning
Event Source: Group Policy Files
Event Category: (2)
Event ID: 4098
Date: 11/20/2012
Time: 11:59:30 PM
User: NT AUTHORITYSYSTEM
Computer: Desktop-013
Description:
The user ‘NRTDDE.INI’ preference item in the ‘User Policy (XP Desktops) {B9EFD8C6-627D-4D72-A42B-E36357AC1490}’ Group Policy object did not apply because it failed with error code ‘0x80070005 Access is denied.’ This error was suppressed.
Обновлено 07.04.2016
Ошибка 0x80070005 отказано в доступе-00
Всем привет сегодня расскажу как решается ошибка 0x80070005 «Отказано в доступе» в Windows 8.1 наиболее часто встречается в трех случаях — при установке обновлений Windows, активации системы и при восстановлении системы. Если же аналогичная проблема возникает в других ситуациях, как правило, решения будут теми же, так как причина ошибки одна. В этой инструкции подробно опишу работающие в большинстве случаев способы исправить ошибку доступа восстановления системы и установки обновлений с кодом 0x80070005. К сожалению, рекомендуемые шаги не гарантированно приводят к ее исправлению: в некоторых случаях требуется вручную определять, к какому файлу или папке и какому процессу требуется доступ и предоставлять его вручную. Описанное ниже подойдет для Windows 7, 8 и 8.1 и Windows 10.
Исправляем ошибку 0x80070005 с помощью subinacl.exe
Первый способ в большей степени относится к ошибке 0x80070005 при обновлении и активации Windows, так что если проблема у вас возникает при попытке восстановления системы, рекомендую начать со следующего способа, а уже потом, если не поможет, вернуться к данному.
Для начала, загрузите утилиту subinacl.exe с официального сайта Microsoft и установите ее на компьютер. При этом, рекомендую устанавливать в какую-то папку, близкую к корню диска, например C:subinacl (именно с таким расположением я буду приводить пример кода далее).
Ошибка 0x80070005 отказано в доступе-01
После этого, запустите Блокнот и введите в него следующий код:
@echo off Set OSBIT=32 IF exist "%ProgramFiles(x86)%" set OSBIT=64 set RUNNINGDIR=%ProgramFiles% IF %OSBIT% == 64 set RUNNINGDIR=%ProgramFiles(x86)% C:subinaclsubinacl.exe /subkeyreg "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionComponent Based Servicing" /grant="nt servicetrustedinstaller"=f @Echo Gotovo. @pause
В блокноте выберите «Файл» — «Сохранить как», затем в диалоговом окне сохранения выберите в поле «Тип файла» — «Все файлы» и укажите имя файла с расширением .bat, сохраните его (я сохраняю на рабочий стол).
Ошибка 0x80070005 отказано в доступе-02
Кликните правой кнопкой мыши по созданному файлу и выберите пункт «Запуск от имени Администратора». По завершении вы увидите надпись: «Gotovo» и предложение нажать любую клавишу. После этого закройте командную строку, перезагрузите компьютер и попробуйте выполнить ту операцию, которая выдавала ошибку 0x80070005 снова.
Если указанный сценарий не сработал, попробуйте аналогичным образом еще один вариант кода (Внимание: код ниже может привести к неработоспособности Windows, выполняйте его только если готовы к такому исходу и знаете, что делаете):
@echo off C:subinaclsubinacl.exe /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f C:subinaclsubinacl.exe /subkeyreg HKEY_CURRENT_USER /grant=administrators=f C:subinaclsubinacl.exe /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f C:subinaclsubinacl.exe /subdirectories %SystemDrive% /grant=administrators=f C:subinaclsubinacl.exe /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f C:subinaclsubinacl.exe /subkeyreg HKEY_CURRENT_USER /grant=system=f C:subinaclsubinacl.exe /subkeyreg HKEY_CLASSES_ROOT /grant=system=f C:subinaclsubinacl.exe /subdirectories %SystemDrive% /grant=system=f @Echo Gotovo. @pause
После запуска скрипта от имени администратора, откроется окно, в котором в течение нескольких минут поочередно будут меняться права доступа на разделы реестра, файлы и папки Windows, по завершении нажмите любую клавишу.
Ошибка 0x80070005 отказано в доступе-03
Вот так вот просто решается Ошибка 0x80070005 отказано в доступе в Windows 8.1.
Материал сайта pyatilistnik.org