Microsoft KB Archive Search

Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

  1. Home
  2. Error message when a domain administrator or a local administrator uses the GPResult.exe tool or runs an RSoP query in Windows Server 2003: “Access denied”

Error message when a domain administrator or a local administrator uses the GPResult.exe tool or runs an RSoP query in Windows Server 2003: “Access denied”

View products that this article applies to.

Symptoms

Consider the following scenario:
  • You are logged on to a Microsoft Windows Server 2003 Standard Edition-based computer as a domain administrator or as a local administrator.
  • You run the Group Policy Results (GPResult.exe) command line tool.
  • You have several Windows Server 2003 member servers that share the same organizational unit (OU).
In this scenario, you may receive an “Access denied” error message on most of the computers on which GPResult is run.

When you perform a Resultant Set of Policy (RSoP) query, you may receive an error message that resembles the following:
The Rsop snap-in was unable to generate the Rsop data due to the error listed below.
Access is denied.

↑ Back to the top

Resolution

This symptom can be caused by incorrect permissions for the RSOP namespace in WMI or insufficient permissions at the NTFS level for the user acccount initiating the GPRESULT command.


- To confirm if the user account has sufficient permissions at the NTFS level, the administrator can run the Procmon.exe tool from Sysinternals (http://technet.microsoft.com/en-en/sysinternals/bb896645) while the GPRESULT command is issued.
Monitor for any 'Access Denied' error messages being logged by Procmon while the administrator issues the GPRESULT command and use these to identify if the NTFS permissions are insufficient to complete the GPRESULT operation.

- Verify that the default permissions for the RSoP namespace are correct by using the WMI Control Microsoft Management Console (MMC) snap in.For more information about WMI namespaces security, click the following article number to view the article in the Microsoft Knowledge Base:

325353 How to set WMI namespace security in Windows Server 2003

  1. If problems persist, troubleshoot the WMI service further. For more information about how to do this, visit the following Microsoft Web site:
    http://www.microsoft.com/technet/scriptcenter/topics/help/wmidiag.mspx

↑ Back to the top

Keywords: kbtshoot, kberrmsg, kbentirenet, kbexpertiseadvanced, kbprb, kb

↑ Back to the top

Article Info
Article ID : 932460
Revision : 1
Created on : 1/7/2017
Published on : 1/7/2017
Exists online : False
Views : 367