Inheritance of ownership in Group Policy Management Console does not work as expected

When GPMC changes the owner of a policy, it updates the entry only on the root object of the policy in Active Directory and on SYSVOL. For the policy GUID quoted in the error message above this would be:

- Cn={C2FFD6A0-21A0-4A74-A874-EE261B42BF96},cn=policies,cn=system,dc=contoso,dc=com
- \\contoso.com\sysvol\contoso.com\Policies\{C2FFD6A0-21A0-4A74-A874-EE261B42BF96}

Later, when the new owner changes the Discretionary Access Control List (DACL), they are allowed to do so by default unless “Owner Rights” are set differently. The permissions are set successfully in Active Directory, and the Security Descriptor Propagator (SDPROP), running within the Directory Server, forwards the new permission to the subordinate objects. The owner of the root object does not have to have permissions on the subordinate objects.

On SYSVOL with NTFS, the permissions are also set successfully on the policy root folder. But with NTFS, the client is responsible for inheriting the new permissions to the subordinate object. This is failing with “Access Denied”, because the user is not Owner of the children objects (ADM, USER, MACHINE, GPT.INI).

This can be seen in a network trace of the procedure, or with a process monitor log of the Microsoft Management Console (MMC) instance running the GPMC. Example from PROCMON LOG:

12 13:48:26,3189199 mmc.exe 1980 CreateFile \\dc1.contoso.com\SysVol\contoso.com\Policies\{C2FFD6A0-21A0-4A74-A874-EE261B42BF96}\Adm ACCESS DENIED Desired Access: Read Attributes, Read Control, Write DAC, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a

The “Write DAC” Access Flag will cause the operation on this subordinate object to fail.