Domain security policy error

[venkia9]

When i try to change any thing in Account policies under security settings it gives an error message "an extended error has occurred failed to save my domain.com\SYSVOL\sysvol\mydomain.com\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf

I am login as admin account.

In GptTmpl.inf file at SeNetworkLogonRight showing proper SID

[EINSTEIN_007]

There was a microsoft kb article solution for this issue, that you can follow below:

1. Log off from the computer.
2. Log on to the computer as a user who has administrative rights.
3. Use antivirus software or the Microsoft Windows Malicious Software Removal Tool. Scan the computer and remove any malicious software that is found. For more information, click the following article here.
4. Modify the Gpttmpl.inf file for the default domain policy. By default, the default domain policy GPO is where user rights are defined for a domain controller. By default, the Gpttmpl.inf file for the default domain policy GPO is located in the following folder:
   
   • %SystemRoot%\Sysvol\Sysvol\Domain Name\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\Computer\Microsoft\Windows NT\SecEdit
   
   
   • To modify the Gpttmpl.inf file, follow these steps:
   • •Click Start, click Run, type %SystemRoot%\Sysvol\Sysvol\Domain Name\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\Computer\Microsoft\Windows NT\SecEdit, and then click OK.
   • •Right-click Gpttmpl.inf, and then click Open.
   • •In the Gpttmpl.inf file, look for the following entry:
   • SeNetworkLogonRight = *S-1-5-32-544, *S-1-1-0
   • Note The value *S-1-5-32-544 represents the security identifier (SID) for the Administrators group. The value *S-1-1-0 represents the SID for the Everyone group.
   • •If you do not find the values that are mentioned in step c, add them to the SeNetworkLogonRight entry.
   • •Save the changes that you made to the Gpttmpl.inf file.
5. Restart the computer.

[venkia9]

I am login as administrator account only.
values for SeNetworkLogonRight in GptTmpl.inf file showing *S-1-5-32-544,
*S-1-1-0.

[JAMES_911]

Follow the below method and see if it solves the error that you are getting:

1. You need to make sure that your currently logged user is administrators group in local PC.
2. After that just go to Start> Run > gpedit.msc
3. You then have to locate Computer Configuration>Security Settings>Local policies>User Right Assignments.
4. Latsly, you have to double-click "Access this computer from the network" and make sure "Administrators" is listed, in right pane, if it is not, then add it.

[venkia9]

"Administrators" group is listed in "Access this computer from the network". and i am also login as administrator account.

[sachingdhv]

Hello
Disable antivirus, third party software and try again
Try to restore the default domain controller policy (6AC) from backup
If none of the options work then you can consider recreating the default policy using dcgpofix tool. it's installed on windows 2003 by default run dcgpofix /? for help

-
Sachin