Unable to approve or unapprove a GPO with an account that has full control on the repository. (NETIQKB56317)

fact
NetIQ Group Policy Administrator 4.x

fact
NetIQ Group Policy Administrator 5.0

symptom
Unable to approve or unapprove a GPO with an account that has full control on the repository.

symptom
Some options are unavailable to a GPA user even though they were granted that specific role through the security wizard.

cause
The user is a member of a group which has an explicit 'deny' set on the specific function or functions that are unavailable.

fix

Locate and remove the explicit 'deny' from the user's account.

1. Right click the repository server node in GPA and choose the option 'Save GPP Security Report'.
2. Review  the security report to identify the group with the explicit deny set.
3. Either uncheck the 'deny', or remove the user from the group with the 'deny' set.

Formerly known as NETIQKB56317