Update Group Policy
Permissions after upgrading Window 2000 domains to 2008
If you are upgrading Window 2000 Active Directory domains to Windows Server
2008, it required to update Group Policy Permissions because the Enterprise
Domain Controllers group will not have read access to any existing 2000 GPOs
that were created prior to the upgrade.
To update permissions on all GPOs in a domain
1. At a command prompt, type the following, and then press ENTER:
cd /d %programfiles%\Microsoft Group Policy\GPMC Sample Scripts
2. Type the following, and then press ENTER:
GrantPermissionOnAllGPOs.wsf “Enterprise Domain Controllers” /permission:read
/domain:DNSDomainName /Replace
Using the Replace switch removes existing permissions for the group or user
before making the change. If a group or user is already granted a permission
type that is higher than the new permission type, and you do not specify
Replace, no change is made.
