Windows Forum

Ask something
Discussion Locked

Enterprise Domain Controllers Group

0 helpful
3 replies

by mbrunton

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I recently upgrade 2 of 6 domain controller from Win 2k to Win 2k3. I am
using the new Group policy managment tool and I am getting an error stating
that Enterprise Domain Controllers don't have read access. I am trying to
run the GrantPermissionOnAllGPOs.wsf script, but I get an error stating it
can't find the group. I do find in ADS for "enterprise" and only find
enterprise admins.

Should this group be here when I upgraded?
Can someone check there domain that has been upgraded to see if the group exists?

3 replies

by bfilmfan

Yes it does exist in 2K and 2K3:

SID: S-1-5-9
Name: Enterprise Controllers
Description: A group that includes all domain controllers in a forest that uses an Active Directory directory service. Membership is controlled by the operating system.

Check the Foreign Security Principles and make sure it hasn't gotten lost.

In addition, check the root of the forest to make sure that it does exist in the domain.

by mbrunton

I checked the Foreign Security Principles and the SID is there. What do you mean by check the root of the forest? We only have one domain.

Also when I run the script "GrantPermissionOnAllGPOs.wsf" I get the error

"Enterprise does not exist in the specified domain.
Error Number: '80070534' Error Description: ''

Any ideas?

by tljohnsn

I also got the error:

"Enterprise does not exist in the specified domain.
Error Number: '80070534' Error Description: ''

When I ran:
Cscript GrantPermissionOnAllGPOs.wsf "Enterprise Domain Controllers" /permission:read /domain:DNSDomainName /Replace

It turns out if you copy and paste the command from the ms's site, the quotes are screwy. Edit the command first and replace with normal double quotes, or copy/paste from here.

This discussion is closed to new replies.