Environment
Situation
This service pack for the NetIQ Group Policy Administrator product (GPA) improves usability and resolves previous issues. Many of these improvements were made in direct response to suggestions from our customers. We thank you for your time and valuable input. We hope you continue to help us ensure our products meet all your needs. You can post feedback in the Group Policy Administrator forum on Qmunity, our community Web site that also includes product notifications, blogs, and product user groups.
This document outlines why you should install this service pack, provides information about installing this service pack, and identifies known issues.
For more information about this release and for the latest documentation, see the GPA Documentation Web page.
What's New?
GPA is an enterprise-wide, Group Policy change control solution that helps you quickly take advantage of the powerful features Group Policy technology offers. Much more than just a replacement for other tools, GPA helps you easily implement Group Policy technology and easily manage GPOs. The following sections outline the key features and functions provided by this version, as well as issues resolved in this release.
For the list of software fixes and enhancements in previous releases, see Previous Releases.
- New Preview Export Feature
- Send for Approval and Reject Options Added to GPO Workflows
- Waiting for Approval Status Added
- Activity Report Now Available in GPA Console
- Parameters Removed from Activity Report CLI
- Enhanced Search GPOs Report
- RSoP Wizard Analyzes Link Order Changes
- Supports Microsoft Internet Explorer 10
- Updated User Guide and New Documentation Support Page
- Resolves an Issue Where GPA Generated an Audit Failure Event When Exporting GPOs
- Resolves an Issue Where the Offline Mirror Wizard Crashed in Large Environments
- Resolves an Issue Where the Additional Permissions Required to Add and Remove Repository Users Was Not Documented
- Resolves an Issue Where the Set Domain Controller Script Requires Local Administrator Permission Was Not Documented
- Resolves an Issue Where the GPA Console Stopped Responding and the MMC Crashed After Deleting a GPO
New Preview Export Feature
You can now preview whether a GPO is ready to export without causing errors. This feature detects common errors and displays the errors or warnings you need to address before exporting. Some common checks include:
- Checking permissions in Active Directory
- Checking permissions in the GP Repository
- Checking whether specific features and services are enabled or running
When you preview a GPO export, you see a report that details each item checked and the status of the check. You can also begin the export operation or schedule it for later from this window.
Send for Approval and Reject Options Added to GPO Workflows
GPO Editors can now send edited GPO versions for approval. GPO Approvers can now reject GPO versions, and include comments in the notification, that are in Waiting for Approval status.
Waiting for Approval Status Added
When a GPO has been sent for approval, its status now shows as Waiting for Approval.
Activity Report Now Available in GPA Console
In previous versions of GPA, the Activity report was available only through the command-line interface. Now, the GPA Console allows you to generate a GPO activity tracking report as an HTML file.
When you are connected to a GP Repository, you can run the Point in Time Analysis and Activity Report using various criteria:
- Domain
- All users or a specific user
- Type of activity
- Various date ranges
To run an Activity Report from the GPA Console, select a GP Repository, and on the Action menu, click Activity Report.
Parameters Removed from Activity Report CLI
The following parameters have been removed from the Point in Time Analysis and Activity Report CLI:
- /span
- /details
- /overwrite
Update any scripts you have in place for this report, if needed.
Enhanced Search GPOs Report
The Search GPOs report contains additional features to improve your ability to interact with search results. When GPA displays your search results, you can take actions, including:
- Start GPO Editor
- Save the Settings Report
- Save the Health Check Report
- Perform workflow operations, such as checking in or approving GPOs
To see all the actions available, run a Search GPO Report. In the results, right-click on an AD GPO or a GP Repository GPO.
RSoP Wizard Analyzes Link Order Changes
The RSoP Wizard now has the option to analyze GPO link order and determine how the settings would be applied if the link order is modified in the GP Repository and the GPO is exported to AD. You can analyze the potential impact on all users, helping you to decide the best sequence for deploying GPOs.
Supports Microsoft Internet Explorer 10
This version supports using Microsoft Internet Explorer 10 to generate GPA reports.
Updated User Guide and New Documentation Support Page
This version contains an updated User Guide. The help topics displayed from the GPA Console are not updated with the latest changes for features being delivered in this release. For the most up-to-date information, see the User Guide.
The documentation for this product is now available on the NetIQ Web site in HTML and PDF formats on a page that does not require you to log in. If you have suggestions for documentation improvements, click Add Comment at the bottom of any page in the HTML versions of the documentation posted at www.netiq.com/documentation.
Resolves an Issue Where GPA Generated an Audit Failure Event When Exporting GPOs
When exporting a GPO from a GPA Console in an untrusted domain to Active Directory, GPA generated an Audit Failure event even though the GPO was successfully exported. This service pack resolves the issue. (ENG327604)
Resolves an Issue Where the Offline Mirror Wizard Crashes in Large Environments
The Offline Mirror Wizard now completes successfully when running in a large environment. (ENG321265)
Resolves an Issue Where the Additional Permissions Required to Add and Remove Repository Users Was Not Documented
The User Guide has been updated to say that a non-SQL administrator user must have the securityadmin role in SQL Server and db_owner database role in the GPO_Repository database to be able to add users to the GP Repository and remove users from the GP Repository. (DOC326808)
Resolves an Issue Where the Set Domain Controller Script Requires Local Administrator Permission Was Not Documented
The User Guide has been updated to say that you must run the Set Domain Controller script as a local administrator. (DOC324769)
Resolves an Issue Where the GPA Console Stopped Responding and the MMC Crashed After Deleting a GPO
After upgrading GPA from GPA 6.5 to GPA 6.6 and installing Service Pack 2, if you delete a GPO, the GPA Console now responds and the MMC remains running. (ENG327420)
Installing This Version
To install this version, run GPA66000_SP2.exe on each GPA Server and GPA Console computer. You must be running Group Policy Administrator 6.6 or 6.6 SP 1 to install this service pack.
The following installation and upgrade issues are currently being researched. If you need further assistance with any issue, please contact NetIQ Technical Support (www.netiq.com/support).
- Installation Program Ends with Error 1722 When Upgrading GPA
- Prerequisite Checker for GPA 6.6 Does Not List GPMC for Some Environments
- Recommend Upgrading Using Same User Account as the Original Installation
- GPA Does Not Provide Option to Uninstall Service Pack
- Hotfix Files Not Removed During Uninstall
- Installing the GPA Console on a Computer with Microsoft SQL Server 2005 Express Edition and Either Microsoft Windows Server 2008 Service Pack 1 or 2 or Microsoft Windows Vista Service Pack 1 or 2 Generates Information Events
- Installing RSAT on Microsoft Windows Vista Service Pack 2
- Installing the GPA Console Using a Group Policy Object
- Installing Additional GPA Components if You Remotely Install the GP Repository
Installation Program Ends with Error 1722 When Upgrading GPA
The installation program does not complete and displays Error 1722 when you upgrade GPA 6.5 to GPA 6.6. (ENG329512)
To work around this issue:
- Start the GPA 6.6 installer.
- Enter all the details in the GPA 6.6 Installation window.
- Pause the GPA 6.6 installation in the last window.
- Open the temp folder using the %temp% command in the Run window.
- Check that the temp folder ends with the number. For example: C:\Users\Admin\AppData\Local\Temp\2
- Copy the {ADD2AA90-241A-4CD3-964C-B7303F264E66} folder from the %temp% folder in the previous step into the parent folder. For example: C:\Users\Admin\AppData\Local\Temp
- Continue the GPA 6.6 installation.
Prerequisite Checker for GPA 6.6 Does Not List GPMC for Some Environments
When you run the prerequisite checker for GPA 6.6 on computers running Windows Server 2012 or Windows 8 and you select the console or server components, the Prerequisite Status section does not list GPMC as a prerequisite as it should. GPMC is a prerequisite for installing the GPA Server and the GPA Console. (ENG325675)
Recommend Upgrading Using Same User Account as the Original Installation
When upgrading from a previous version of GPA, log on with the same user account used during the original GPA installation. (ENG300042)
If you are unable to do this, complete the following steps:
- Attempt to upgrade to GPA 6.6 using a different user account than the original installation (UserB).
- When the installation ends, review the log file for the name of the temp folder that is missing.
- Locate the temp folder from the first user account (UserA) in %user profile%Temp.
- Copy the temp folder contents from the UserB path to the UserA path.
- Run the upgrade steps again.
GPA Does Not Provide Option to Uninstall Service Pack
When upgrading to Service Pack 1 or Service Pack 2, GPA does not provide an option to uninstall the service pack. (DOC326179)
Hotfix Files Not Removed During Uninstall
Uninstalling GPA does not remove files and folders created by the hotfix installer. You must remove these files and folders manually. (ENG314337)
Installing the GPA Console on a Computer with Microsoft SQL Server 2005 Express Edition and Either Microsoft Windows Server 2008 Service Pack 1 or 2, or Microsoft Windows Vista Service Pack 1 or 2 Generates Information Events
After installing the GPA Console on a computer with Microsoft SQL Server 2005 Express Edition and either Microsoft Windows Server 2008, including Service Pack 1 or 2, or Microsoft Windows Vista Service Pack 1 or 2, when you open the Event Viewer console and expand Windows Logs > Application, some of the application events have the description Login failed for user 'NT AUTHORITY\SYSTEM'. [CLIENT: named pipe]. You can ignore these events. (ENG255755)
Installing RSAT on Microsoft Windows Vista Service Pack 2
You cannot install Remote Server Administration Tools (RSAT) on Microsoft Windows Vista Service Pack 2 although RSAT is supported on Service Pack 2. To work around this issue, install RSAT on Microsoft Windows Vista Service Pack 1, and then upgrade to Microsoft Windows Vista Service Pack 2. For more information about this issue, see the Microsoft Web site. (DOC270814)
Installing the GPA Console Using a Group Policy Object
If you use a GPO to deploy the GPA Console installation, ensure all prerequisites for installing the GPA Console are installed on the target computer prior to applying the GPO containing the GPA software package. If the computer does not meet the prerequisites, the GPA installation fails. (ENG252451)
Installing Additional GPA Components if You Remotely Install the GP Repository
If you remotely install the GP Repository and then run the setup program again on the local computer, the setup program displays upgrade windows rather than allowing you to add additional GPA components. This issue is caused by registry entries on the local computer for the remote database installation. (ENG263510)
To work around this issue:
- On the local computer, run the gpa.msi file and choose the Remove option.
- Run the setup program to add GPA components to the local computer.
Known Issues
NetIQ Corporation strives to ensure our products provide quality solutions for your enterprise software needs. The following issues are currently being researched. If you need further assistance with any issue, please contact NetIQ Technical Support (www.netiq.com/support).
- GPOs Imported from AD Using a Previous Version of GPA Retain Their Approval Status in GPA Console
- Event Log Shows Audit Failure When GPO Export Successful
- Unable to Export GPO Using Export Only Account
- Date Formats in Reports Do Not Match Region and Language of GPA Console
- Setup Wizard Does Not Run from Programs and Features on Windows Server 2012 and Windows 8 Computers
- RSoP Report Missing Information on Windows Server 2012 and Windows 8 Computers
- GPO Comparison Report Does Not Include Some Settings in Favorites and Links Folders
- Some ADMX Settings Not Indexed Correctly
- Active Directory GPOs May Remain in GPA Indexes
- Computer Configuration Values Unavailable for 64-bit Computers in Search
- Does Not Connect to Read-Only Domain Controllers
- The Links Tab Sometimes Does Not List All GPO Links to the Selected Domain in GP Explorer
- The GPR Security Tab on the Properties Window for a Domain, Category, or GPO Displays Deleted User Accounts
- The Block Inheritance Setting Is Not Imported When You Import a GPO from Active Directory into the GP Repository
- Issues with Simultaneously Using Two GPA Consoles
- Size Limit of Security Descriptors in the Database
- Exclude Migration Options Do Not Work When You Have Two GP Repository Connections
- GPA Does Not Create Events or Send Email Notifications When Exporting GPOs with the Export Only Account
- GPA Displays an Error When You Try to Export a GPO to Active Directory Using an Export Only Account that Has Deny All Permission on AD Containers
- The GPA Console Does Not Allow You to Create a New GPO in the GP Explorer If You Restore a Previously Backed Up GPO That Has a Link to a Deleted OU
- GPA May Not Be Able to Support IP Addresses Using Internet Protocol Version 6 Format
- The GPA Console May Require Restarting If You Leave It Inactive over a Period of Time
- GPA Does Not Automatically Update the Current Status of a GPO after Rolling Back a GPO to a Previous Version
- GPA Does Not Display the Current Domain in the Location Text Box on the Select User Window
- Special Permissions Are Required to Add A GPO For Synchronization with the Master GPO
- Issues with GPMC Reporting
- Issues with the RSoP Analysis Report Results
- Issues with Extensions of Microsoft Group Policy Management Editor Console
- Security Filters Section of the Health Check Report Displays Inconsistent Information
- GPA Does Not Refresh the General Settings Available in the GPO Settings Report When the GPO is Checked Out
- GPA Sometimes Displays a Blank Enterprise Consistency Check Report
- The NqGPASyncLinkOrder Tool Does Not Synchronize the Block Inheritance and Link Order Information of GPOs When You Rename or Delete an OU in Active Directory
- The NqGPASyncLinkOrder Tool Does Not Update the GPO Link Order If a Domain User Runs the Tool
- Issues with New Policy Settings in Microsoft Windows Vista Service Pack 1 or Microsoft Windows Server 2008
- Automatic Deletion of ADML Files Sometimes Not Occurring in the GP Repository
- GPMC Cannot Import Settings of a GPO Backed Up With GPA
- Deleting a Domain Using a GPA Console on Microsoft Windows Vista Service Pack 1 or 2 Does Not Delete the Corresponding Policy Definition Folder
- GPA Sometimes Does Not Display the Context Menu and Toolbar When You Select a Deployed Printer
- Security and Network Path Map Tabs Are Empty if Master GPO has GPOs from Different Domains
- Menus, Policy, and Preference Folders Missing or Not Working Properly on Microsoft Windows Vista Service Pack 1 (64-bit)
- GPA Console Does Not Recognize or Display Reports for IP Security Policy Management Assignments
- GPO Settings Report Does Not Import Wired and Wireless Network Settings from a Backup
- GPO Console Displays Error in the GPO Settings Report When Upgrading MSI Packages from Current GPO
GPOs Imported from AD Using a Previous Version of GPA Retain Their Approval Status in GPA Console
The approval status has been changed in GPA 6.6 SP 2, and it applies only after installing SP 2. For example, if you imported a GPO in GPA 6.6, the approval status was Not Approved. If you import a GPO in GPA 6.6 SP 2, the approval status is Exported. For those GPOs imported before applying SP 2, the approval status will remain Not Approved. (DOC329089)
Event Log Shows Audit Failure When GPO Export Successful
When exporting a GPO using an EOA from a trusted GPA Console over an untrusted domain, the event log shows an audit failure even though the export is successful. (ENG330261)
Unable to Export GPO Using Export Only Account
When you try to export a GPO to an untrusted domain and you did not configure the EOA account but you enter untrusted domain credentials during the export operation, GPA displays an error that the GPO cannot be exported because it is unable to access to the container. (ENG330318)
To work around this issue, provide the Untrusted Access Account for the untrusted domain when prompted for credentials during the GPO export.
Date Formats in Reports Do Not Match Region and Language of GPA Console
Date formats in reports may not match the region and language settings of the GPA Console that created the report. (ENG318586)
Setup Wizard Does Not Run from Programs and Features on Windows Server 2012 and Windows 8 Computers
You must disable UAC on Microsoft Windows Server 2012 and Windows 8 computers to change or uninstall Group Policy Administrator using Programs and Features in Control Panel. (DOC326918)
To disable UAC on Windows Server 2012 and Windows 8:
- In Server Manager, click Tools>Security policy settings.
- Expand Computer Configuration>Windows Settings>Security Settings>Local Policies>Security Options.
- Scroll to the bottom and disable all UAC related settings.
- Restart the computer, and then change or uninstall GPA.
RSoP Report Missing Information on Windows Server 2012 and Windows 8 Computers
When you generate the RSoP report on a computer running Windows Server 2012 or Windows 8 and use the What-if rule: “Repository GPO is exported”, some information is missing from the Group Policy Objects (Applied, Denied) sections.
To work around this issue, view the information on the Applied GPOs tab of the report. (ENG327075)
GPO Comparison Report Does Not Include Some Settings in Favorites and Links Folders
When you generate a GPO Comparison report for a GPO where one version of the GPO contains no settings in the Favorites and Links folders, the report may not show the Favorites and Links settings in either version of the GPO.
To work around this issue, select the GPO that contains settings in the Favorites and Links folder as the first GPO to compare, and select the GPO without settings in the Favorites and Links folder as the second GPO to compare. (ENG324953)
Some ADMX Settings Not Indexed Correctly
Some ADMX settings include blank spaces when indexed. As a result, GPA does not find all GPOs when searching for GPOs using ADMX settings as criteria. For more information about these issues, see NetIQ Knowledge Base Article NETIQKB7011450, available at https://www.netiq.com/support/kb. (ENG323696)
Active Directory GPOs May Remain in GPA Indexes
When the GPA Security Account is not a member of the Domain Admins group, and you delete GPOs in AD, they are not deleted from the GPA indexes. You must grant permission for the GPA Security Account to view the Deleted Objects Container folder. To do this, the GPA Domain Administrator must run the following commands from a command prompt:
- dsacls "CN=Deleted Objects,DC=DomainName,DC=com" /takeownership
- dsacls "CN=Deleted Objects,DC=DomainName,DC=com" /g DomainName\UserName:LCRP
For more information, see the Microsoft knowledgebase article at http://support.microsoft.com/kb/892806. (ENG325447)
Computer Configuration Values Unavailable for 64-bit Computers in Search
A known issue exists with generating a search report using Computer Configuration where some values are not available for Microsoft Windows 64-bit computers. The following values are not available. (ENG315000)
Windows Server 2008 R2 SP1 or Windows 7 (64-bit):
- Audit Policy Configuration
- Internet Protocol Security Policies
- Registry
- Remote Desktop USB Redirection
Windows Server 2008 SP1 (64-bit) or Windows Vista SP2 (64-bit):
- Deployed Printer Connections
- Registry
Does Not Connect to Read-Only Domain Controllers
GPA does not allow you to connect to read-only domain controllers. You can only connect to domain controllers that are writeable.
The Links Tab Sometimes Does Not List All GPO Links to the Selected Domain in GP Explorer
When you create and link a GPO to an OU in the parent domain, and then link the same GPO to an OU in the child domain, if you click the Links tab after selecting the parent domain under the GP Explorer node, the Links tab does not list the GPO link to the OU in the child domain. (ENG207311)
The GPR Security Tab on the Properties Window for a Domain, Category, or GPO Displays Deleted User Accounts
If you delete a user account using Active Directory, the GPR Security tab on the Properties window for a domain, category, or GPO displays the deleted user account. For more information about this issue, contact the Microsoft technical support team. (ENG193071)
The Block Inheritance Setting Is Not Imported When You Import a GPO from Active Directory into the GP Repository
If you have a GPO that is linked to an OU in Active Directory that has block inheritance either enabled or disabled and you import this GPO from Active Directory into the GP Repository, the import process does not import the block inheritance setting of the OU. After the import process, the block inheritance setting of the imported GPO remains as Not Defined until you check out the GPO and explicitly change the block inheritance setting. (ENG234673)
Issues with Simultaneously Using Two GPA Consoles
A known issue exists with using two different GPA Console sessions open at the same time on the same computer. If you use the first GPA Console to delete the GPO link in the GP Repository without refreshing the information, and you use the second GPA Console to delete the GPO in the GP Repository, the second GPA Console displays a runtime error and shuts down. (ENG219893)
This is a known issue with the MMC snap-in when you simultaneously work with two MMC consoles on the same computer. For more information about this issue, contact the Microsoft technical support team.
Size Limit of Security Descriptors in the Database
If a GPO has a security descriptor that is greater than 7 KB in size, it adversely affects many GPA operations. (ENG211221)
Exclude Migration Options Do Not Work When You Have Two GP Repository Connections
A known issue exists with having two GP Repository connections and configuring the GPO Properties to Exclude During a Migration/Synchronization settings in one or both of the GP Repository connections to exclude the GPO links, WMI filters, and delegation settings. If one of the GP Repositories has a GPO with GPO links, WMI filters, and delegation settings configured, when you migrate this GPO to a domain in the other GP Repository connection, GPA does not correctly apply the excluded settings. (ENG248613)
GPA Does Not Create Events or Send Email Notifications When Exporting GPOs with the Export Only Account
If you configure an Export Only account, GPA does not create GP Repository events or send email notifications when you export a GPO. (ENG204784)
GPA Displays an Error When You Try to Export a GPO to Active Directory Using an Export Only Account that Has Deny All Permission on AD Containers
A known issue exists when you have a domain configured with an Export Only account and you create a GPO in the GP Repository and link it to an OU in Active Directory. If you also create a user who is a member of the Domain Admins and Group Policy Creator Owner groups and is also configured with the Export Only account, but this account has Deny All permission on the same OU in Active Directory, when you try to export the GPO to Active Directory, GPA displays an error. (ENG255856)
The GPA Console Does Not Allow You to Create a New GPO in the GP Explorer If You Restore a Previously Backed Up GPO That Has a Link to a Deleted OU
If you try to restore a backed up GPO that has a link to a deleted OU in Active Directory, the GPA Console does not allow you to perform this operation and consequently prevents you from creating a new GPO in the GP Explorer. To avoid this issue, do not restore backed up GPOs that have links to a deleted OU in Active Directory. (ENG238784)
GPA May Not Be Able to Support IP Addresses Using Internet Protocol Version 6 Format
If you have GPOs with IP addresses using the Internet Protocol version 6 (IPv6) format, GPA may not allow you to edit the IPv6 addresses and the GP Repository may not be able to store the IPv6 addresses. If this issue occurs, contact NetIQ Technical Support. (DOC254873)
The GPA Console May Require Restarting If You Leave It Inactive over a Period of Time
If you generate an RSoP analysis report, and then leave the GPO Console inactive over a period of time, the GPA Console may not work properly. To work around this issue, close and open the GPA Console. (ENG250783)
GPA Does Not Automatically Update the Current Status of a GPO after Rolling Back a GPO to a Previous Version
If you roll back an approved GPO to a version where the GPO is unapproved or roll back an unapproved GPO to a version where the GPO is approved, GPA does not automatically display the current status of the GPO. Refresh the GPO to see the current status of the GPO. (ENG241142)
GPA Does Not Display the Current Domain in the Location Text Box on the Select User Window
If you are using the GPA Console on a computer linked to a child domain, when you try to associate the GPA server with the GP Repository, the Location text box on the Select User window displays the parent domain as the default domain. (ENG228156)
Special Permissions Are Required to Add A GPO For Synchronization with the Master GPO
You need to be a member of the GPA_REPOSITORY_MANAGEMENT group to add a GPO for synchronization with the master GPO. (ENG242479)
Issues with GPMC Reporting
GPA reports have the same limitations as Microsoft Group Policy Management Console (GPMC). For more information about these issues, see NetIQ Knowledge Base Article NETIQKB71406, available at https://www.netiq.com/support/kb.
Issues with the RSoP Analysis Report Results
We are currently researching some issues related to RSoP Analysis Reports. For more information about these issues, see NetIQ Knowledge Base Article NETIQKB71364, available at https://www.netiq.com/support/kb.
Issues with Extensions of Microsoft Group Policy Management Editor Console
There are some issues with extensions of Microsoft Group Policy Management Editor (GPME) console at times when you load and configure these extensions from the new nqGPME console. For more information about these issues, see NetIQ Knowledge Base Article NETIQKB72431 available at https://www.netiq.com/support/kb.
Security Filters Section of the Health Check Report Displays Inconsistent Information
When you generate the Health Check report for GPOs in the GP Repository, the information available in the Security Filters section of the Health Check report does not match the information available in the Security Filters section of the Health Check report you generate for the same GPOs in Active Directory. (ENG241193)
GPA Does Not Refresh the General Settings Available in the GPO Settings Report When the GPO is Checked Out
If you check out a GPO and change some settings under the Details, Links, Security Filters, WMI Filtering, or Delegation section, when you refresh the GPO, the GPO Settings report does not reflect the changes made to any of these sections. However, you can see the changes to these settings on the tabs. Also, the GPO Settings report correctly reflects the changes made to the User Configuration and Computer Configuration sections when the GPO is checked out. (ENG240877)
GPA Sometimes Displays a Blank Enterprise Consistency Check Report
When you log on to a GPA Console computer using a domain user account that does not have any GPR Security permissions, if you try to generate the Enterprise Consistency Check report for GPOs in the GP Repository, GPA displays a blank Enterprise Consistency Check report. GPA also displays a blank Enterprise Consistency Check report when you try to compare the Active Directory version and the GP Repository version of each master GPO. To work around this issue, assign the GPO Editor role to the domain user account. (ENG242925)
The NqGPASyncLinkOrder Tool Does Not Synchronize the Block Inheritance and Link Order Information of GPOs When You Rename or Delete an OU in Active Directory
If you rename or delete one or more OUs in Active Directory, and then run the NqGPASyncLinkOrder tool to synchronize the block inheritance and link order information of GPOs in the GP Repository with the current information in Active Directory, the NqGPASyncLinkOrder tool does not synchronize the block inheritance and link order information of the GPOs linked to these OUs in the GP Repository. To avoid this issue, in the GPA Console, select the domain you want to synchronize under the GP Repository, and then click Sync with AD on the GPO Link Scope tab of the domain Properties window. (ENG244447)
The NqGPASyncLinkOrder Tool Does Not Update the GPO Link Order If a Domain User Runs the Tool
If a domain user runs the NqGPASyncLinkOrder tool, the tool does not update the link order because the user does not have the necessary permissions on the database. To avoid this issue, provide the domain user Execute permission on the GPO_REPOSITORY database and on certain stored procedures in the database. For more information about the stored procedures, see NetIQ Knowledge Base Article NETIQKB71338, available at https://www.netiq.com/support/kb. (ENG250848)
Issues with New Policy Settings in Microsoft Windows Vista Service Pack 1 or 2 or Microsoft Windows Server 2008
We are currently researching some issues related to configuring group policy settings introduced in either Microsoft Windows Vista Service Pack 1 or 2 or Microsoft Windows Server 2008. For more information about these issues, see NetIQ Knowledge Base Article NETIQKB71364, available at https://www.netiq.com/support/kb.
Automatic Deletion of ADML Files Sometimes Not Occurring in the GP Repository
After synchronizing ADMX and ADML files from the central store to the GP Repository, when you delete an ADML file without deleting the corresponding ADMX file from the central store, and then synchronize the ADMX and ADML files again from the central store to the GP Repository, the GP Repository does not delete the corresponding ADML file from the local folder for the domain, \installDir\Local GPOs\GPAPolicyDefinitions. For more information about the workaround to this issue, see NetIQ Knowledge Base Article NETIQKB71198, available at https://www.netiq.com/support/kb. (ENG238129)
GPMC Cannot Import Settings of a GPO Backed Up With GPA
The format of the backup set in GPMC has changed between previous versions of the Microsoft Windows operating system and Microsoft Windows Vista Service Pack 1 or 2, Microsoft Windows 7, Microsoft Windows Server 2008, or Microsoft Windows Server 2008 R2. Consequently, if you used GPA to back up GPOs on a computer running either Microsoft Windows Server 2003 or Microsoft Windows XP, you cannot import the backup set using GPMC on Microsoft Windows Vista Service Pack 1 or 2, Microsoft Windows 7, Microsoft Windows Server 2008, or Microsoft Windows Server 2008 R2. (ENG249387)
Deleting a Domain Using a GPA Console on Microsoft Windows Vista Service Pack 1 or 2 Does Not Delete the Corresponding Policy Definition Folder
If you use the GPA Console on a computer running Microsoft Windows Vista Service Pack 1 or 2 to delete a domain from the GP Repository, GPA does not delete the corresponding domain-specific policy definition folder under \installDir\Local GPOs\domain\PolicyDefinitions. When you delete a domain from the GP Repository, delete the domain-specific policy definition folder. (ENG234117)
GPA Does Not Display the Context Menu and Toolbar When You Select a Deployed Printer
If you are using the GPA Console on a computer running Microsoft Windows Vista Service Pack 1 or 2, or Microsoft Windows Server 2008, and if you have deployed a printer using either the Computer Configuration/Windows Settings/Deployed Printers settings or the User Configuration/Windows Settings/Deployed Printers settings, when you select the deployed printer in the results pane, GPA does not display the context menu and toolbar. (ENG242129)
Security and Network Path Map Tabs Are Empty if Master GPO has GPOs from Different Domains
If a master GPO has different controlled GPOs from different domains and then you add another controlled GPO and click the Update Domain Map button, the Security Map and Network Path Map tabs are empty for the previously added GPO. To avoid this issue, clear Only show mapping for the GPO, and then update the Target Security and Network Map information. (ENG274718)
Menus, Policy, and Preference Folders Missing or Not Working Properly on Microsoft Windows Vista Service Pack 1 (64-bit)
Microsoft did not include the following Multilingual User Interface files in the %systemroot%\SysWOW64\en-US folder on Microsoft Windows Vista Service Pack 1 (64-bit):
- gpme.dll.mui
- AdmTmpl.dll.mui
These missing files cause the following issues in the GPA Console:
- Some policy folders are missing
- Action menu items for Administrative templates are empty or not working properly
- Group Policy Preference Extension folders are missing
To check for a workaround to this issue or a fix from Microsoft, see NetIQ Knowledge Base Articles NETIQKB71721 and NETIQKB71722, available at https://www.netiq.com/support/kb. (DOC266982, DOC266577, ENG260726)
GPA Console Does Not Recognize or Display Reports for IP Security Policy Management Assignments
When you make any IP Security Policy Management setting in GP Explorer or GP Repository from a GPA Console running on Windows Vista Service Pack 1 or 2, Microsoft Windows 7, Microsoft Windows Server 2008 Service Pack 1 or 2 or Microsoft Windows Server 2008 R2 computer, the console displays an error message and you cannot assign the policy. In addition, the console does not display the policy settings on the GPO Settings report. (ENG286345)
GPO Settings Report Does Not Import Wired and Wireless Network Settings from a Backup
If you import a GPO from a backup, and the GPO has Wired Network (IEEE 802.3) and/or Wireless Network (IEEE 802.11) policies configured, the GPO Settings Report does not display these settings. (ENG295423, ENG277974)
GPO Console Displays Error in the GPO Settings Report When Upgrading MSI Packages from Current GPO
When upgrading an MSI package from the current GPO, the GPO Settings Report displays an error in the Software Settings section, instead of showing the MSI package information. To avoid this issue, add the MSI package from a specific GPO. (ENG287259)
Previous Releases
This service pack also includes enhancements and fixes added in Group Policy Administrator 6.6 Service Pack 1.