Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. You receive a "constraint violation occurred" error message when you assign an IPsec policy on a Windows Server 2003-based computer

You receive a "constraint violation occurred" error message when you assign an IPsec policy on a Windows Server 2003-based computer

Symptoms

Consider the following scenario. You create an organizational unit (OU) in the Active Directory directory service on a Microsoft Windows Server 2003-based computer. Then, you try to assign an Internet Protocol security (IPsec) policy to the Group Policy object (GPO) of the new OU before this OU is fully replicated. In this scenario, you receive the following error message:
A constraint violation occurred.
This symptom occurs when you are working on a domain controller that is not in the same domain as the primary domain controller (PDC) emulator. Therefore, replication is not immediate.

↑ Back to the top

Cause

By default, the Group Policy Object Editor snap-in connects to the PDC emulator when the Active Directory Users and Computers snap-in connects to the closest domain controller. In this case, the closest domain controller is the local computer.

↑ Back to the top

Workaround

To work around this problem, make sure that the Active Directory Users and Computers snap-in and the Group Policy Object Editor snap-in connect to the same domain controller.

↑ Back to the top

More Information

Steps to reproduce the problem

  1. Set up a Windows Server 2003-based domain controller. Name this domain controller " DC1."
  2. Set up a second Windows Server 2003-based domain controller. Name this domain controller "DC2." Make sure that DC2 is in the same domain as DC1.
  3. Log on to DC2, and then start the Active Directory Users and Computers snap-in.
  4. Create a custom OU.
  5. Select the properties of this OU to change the Group Policy settings.
  6. Modify the GPO.
  7. Create a new IPsec policy, and then try to assign this policy. You receive the error message that is mentioned in the "Symptoms" section.

↑ Back to the top

Keywords: kbtshoot, kbprb, kb

↑ Back to the top

Article Info
Article ID : 907352
Revision : 6
Created on : 4/20/2018
Published on : 4/20/2018
Exists online : False
Views : 125