Group Policy Error - Parameter Incorrect

[Becker]

In SBS 2003, when looking in the server manager at the group policy
management, I go to
right click and edit the default domain policy and I get an error. The
window says:

Group Policy Error
Failed to open the Group Policy Object. You may not have appropriate
rights.
Details:
The parameter is incorrect.

It then opens the Group Policy Object Editory, however it just has a red X
on the root of the tree on the left pane.

I get this when I also open the group policy management icon from admin
tools.

What gives?

I have 1 NIC installed and have setup 10 IPs on this NIC. I have registered
two DNS forward lookup zones, one for my domain name (tradewinds.local) and
another for some other addressing schemes I'm using. Other than that, it's
a fresh install of SBS 2003.

Thanks,
Becker

[Glenn L]

This is often a mismatch with SMB signing settings in the registry on the
server.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]
"enablesecuritysignature"=dword:00000001
"requiresecuritysignature"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters]
"enablesecuritysignature"=dword:00000001
"requiresecuritysignature"=dword:00000001

Go into the registry on the server. If the lanmanserver
'requiresecuritysignature' = 1, then the lanmanworkstation
'enablesecuritysignature' must = 1

If lanmanworkstation 'requiresecuritysignature' = 1, then the lanmanserver
'enablesecuritysignature' must = 1

Verify this configuration. If this is the problem, then change it in the
registry, then open group policy editor and change it in there. Otherwise,
you will be back in the same boat in 5 minutes.
--
Glenn L
CCNA, MCSE 2000/2003 + Security

Post by Becker
In SBS 2003, when looking in the server manager at the group policy
management, I go to
right click and edit the default domain policy and I get an error. The
Group Policy Error
Failed to open the Group Policy Object. You may not have appropriate
rights.
The parameter is incorrect.
It then opens the Group Policy Object Editory, however it just has a red X
on the root of the tree on the left pane.
I get this when I also open the group policy management icon from admin
tools.
What gives?
I have 1 NIC installed and have setup 10 IPs on this NIC. I have registered
two DNS forward lookup zones, one for my domain name (tradewinds.local) and
another for some other addressing schemes I'm using. Other than that, it's
a fresh install of SBS 2003.
Thanks,
Becker

[Becker]

Glenn,

Thanks, I tried this and it didn't seem to work. I tried the information in
another response I got and it seemed to do the trick. The problem was
this:

**********************

From the description, I understand that you encountered a problem in GPO.
When trying to modify (or create) a group policy with Active Directory
Users and Computer or Group Policy Management Console (GPMC) the error
"Failed to open the Group Policy Object. You may not have appropriate
rights. "The parameter is incorrect" occurs. If I am off base, please let
me know.

In order to isolate the problem, please follow the steps below:

1. Can you open a new Microsoft Management Console (MMC) and add the
Group Policy Object Editor" and modify and/or create group policies in
Active Directory.

2. If so there might be caused by the register error. We may go ahead
to check a value in the registry:

HKEY_CLASSES_ROOT\MSCFile\Shell\Open\Command

Could you tell me what the value for default is.
It should be %SystemRoot%\system32\mmc.exe "%1" %*

3. If the you get an "Access denied" error when edit GPO after
changing please do the following
HKEY_CLASSES_ROOT\MSCFile\Shell\Open\Command
%SystemRoot%\system32\mmc.exe "%1" %* and made the key a REG_EXPAND_SZ
type.

Post by Glenn L
This is often a mismatch with SMB signing settings in the registry on the
server.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters]
"enablesecuritysignature"=dword:00000001
"requiresecuritysignature"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\parameters]
"enablesecuritysignature"=dword:00000001
"requiresecuritysignature"=dword:00000001
Go into the registry on the server. If the lanmanserver
'requiresecuritysignature' = 1, then the lanmanworkstation
'enablesecuritysignature' must = 1
If lanmanworkstation 'requiresecuritysignature' = 1, then the lanmanserver
'enablesecuritysignature' must = 1
Verify this configuration. If this is the problem, then change it in the
registry, then open group policy editor and change it in there.
Otherwise, you will be back in the same boat in 5 minutes.
--
Glenn L
CCNA, MCSE 2000/2003 + Security

Post by Becker
In SBS 2003, when looking in the server manager at the group policy
management, I go to
right click and edit the default domain policy and I get an error. The
Group Policy Error
Failed to open the Group Policy Object. You may not have appropriate
rights.
The parameter is incorrect.
It then opens the Group Policy Object Editory, however it just has a red X
on the root of the tree on the left pane.
I get this when I also open the group policy management icon from admin
tools.
What gives?
I have 1 NIC installed and have setup 10 IPs on this NIC. I have registered
two DNS forward lookup zones, one for my domain name (tradewinds.local) and
another for some other addressing schemes I'm using. Other than that, it's
a fresh install of SBS 2003.
Thanks,
Becker