Windows Forum

Ask something
Discussion Locked

Domain Security Policy link broken

0 helpful
10 replies

by christopher hill

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I've got a Windows 2000 native mode domain set up, with the Network Administration tools installed. However, when I try to run either the 'Domain Security Policy' or 'Domain Controller Security Policy' links, the MMC loads but then I get an error: 'The dn syntax is invalid'.

I've no idea why this should happen - the only thing I can think of is that I did rename the two default group policies at one time (Default Domain Policy and Default Domain Controller Policy).

I've looked around a bit, and when I loaded the broken shortcuts into Notepad I noticed that they give a command line option that looks something like this:

/gpobject:"LDAP://CN=,CN=Policies,CN=System,???"

Now, the ??? is the big problem. If I load the MMC templates with the above command line option I get the error I mentioned before. If I replace the ??? with:

DC=crgs,DC=local

which is what I would expect it to be for LDAP access, then it works fine. So what's up with the ???s? Any ideas? How can I fix this? I don't really want to create new shortcuts, I'd like the ones that are created by default to work properly!

BTW if someone could tell me if their copy of the shortcut has the ??? as well it would be appreciated. Just load Notepad and drag the shortcut into it, you'll be able to see the command line option quite clearly.

Thanks!

10 replies

by cportman

To recreate the shortcuts you could try to run adminpak.msi (off the cd)

Probably occured becuase you renamed it.

when i put mine into notepad there are no question marks.

good luck
cp

by joseph moore

I found a Technet article that sort-of listed your error as LDAP_INVALID_DN_SYNTAX with an error code of 0x22. Unfortunately, all it said for this error code was that "The distinguished name has an invalid syntax".
Doesn't really help, does it?
Well, I found another article that basically said if the FQDN on the machine you are working on is different, then you would get a similar error. So, my suggestion here is on the machine you are trying to open MMC on and pull in Group Policy, make sureit is properly configured as a member of the domain/enterprise, with the proper domain DSN suffix.
You might need to look at the machine that you used to change the 2 default policies. Maybe it is set to a different domain, and in the policy rename, it tried to change the domain the 2 policies were in, and was not successful. Maybe that is why you only have ???? now in the script.

The last thing I can suggest is to use LDP.EXE from this machine you are trying to use. Make sure LDP can connect to the AD database. Here is a TechNet article on using LDP.EXE
http://support.microsoft.com/support/kb/articles/Q224/5/43.ASP
(please remove any spaces)

HOpe this helps.

by christopher hill

I've given up and just created two new shortcuts to the following paths:

%windir%\System32\dcpol.msc /gpobject:"LDAP://CN={6AC1786C-016F-11D2-945F-00c04fB984F9},CN=Policies,CN=System,DC=crgs,DC=local"

%windir%\System32\dompol.msc /gpobject:"LDAP://CN={31B2F340-016D-11D2-945F-00C04FB984F9},CN=Policies,CN=System,DC=crgs,DC=local"

This seems to work. While I was fiddling I did notice that there was a registry value called:

HKLM\Software\Microsoft\Administration Tools Package\DOMAINDN
which was also set to ???. Tried setting this to DC=crgs,DC=local but it didn't work. I *think* that the problem is to do with the MSI installer for adminpak.msi not being able to detect the DC=crgs,DC=local part in the registry or something. I also found a mention of ??? in the MSI file around the uninstall section, so maybe it's something to do with that.

I'll leave the question open until it auto closes in case anyone has any ideas as to why it says ???

by sativocomputerservices

Minkus...
I renamed the default dc policy and I get the the same ??? marks as well. I do not however get your same error. When I unloaded AD and reloaded it I started getting the error. This is pretty weird, but I thought you could use the info. I looked in my dns server and I found several directories in that level, not quite sure what you are missing, but check your dns server for the correct path in your ldap entries. This is definitely where the problem is.

Matt

by christopher hill

What parts of the DNS server are you talking about? I found several mentions of LDAP but am not sure which ones to check.

(btw your answer *is* helpful but I don't seem to be able to leave the question open *and* say that it was helpful)

by sativocomputerservices

Minkus...

Go to the dns area for your domain on your dns server. You should see all your dns zones there. You need to open up the zone for your domain (ex domain.ntlworld.com) Under this tree will be all your OU's and containers and a variety of organizational structures. You should see a container for your group policies, simply follwo the LDAP pointer that has the ??? in it to find where the "System" container is. There is wher your problem will be. You need to find the location of the renamed version of your default dc and enter that information into the LDAP shortcut in place of the ???. All LDAP info is stored in dns and you can navigate through it to see just about any information you need for your domain. You can also seewho the PDC is for your 2000 domain at the time!!!

by christopher hill

I've fixed the problem.

What it was is that I had a copy of the Windows 2000 Server CD on the network that adminpak.msi was being installed from. However, I hadn't slipstreamed any service packs into this CD image. Now, in SP1 the ADMINPAK.MSI installer was *updated*. As soon as I slipstreamed SP2 into the Win2K server CD image, the ADMINPAK.MSI file was updated. I reinstalled it on all the affected machines and now the Domain Security Policy and Domain Controller Security Policy links work fine!

I reckon it was because the clients don't install those two admin pack components by default, so when I clicked on them they got installed from the MSI file, which was out of date.

So, anyone who is having the same problem, just make sureyou install the ADMINPAK.MSI from the *latest* service pack (you can get to it by using the -x switch on the Windows 2000 SP2 network installer).

Thanks to all who helped.

This discussion is closed to new replies.