You are using an unsupported browser. Please update your browser to the latest version on or before July 31, 2020.

06: PolicyPak: Troubleshooting License GPO creation

Sometimes administrators have issues when creating the _once a year_ license GPO. This video shows the most common problem the workaround for it. HINT: Try running LT specifically with Domain Admin rights, then try the steps in this video.

PolicyPak: Troubleshooting License GPO creation Video Transcript

Hi, this is Jeremy Moskowitz, former Group Policy MVP and Founder of PolicyPak Software. In this video, we’re going to learn how to troubleshoot installing a license received from PolicyPak.

Let’s go ahead and do that, “Install a license received from PolicyPak.” We’ll go ahead and click “Next.” We’re going to click “Browse” for the file first. Find your license file that we sent you. This is my actual license here. We’ll click “Validate” and click “Create GPO.”

Now if you don’t have rights to create the Group Policy Object, it will ask you first and you’ll click “OK.” It says, “Could not create new license GPO. Do you want to select existing GPO manually?” If you’re getting this, that means that the user who you’re running under doesn’t have create rights and possibly link rights in the GPMC.

Here’s how we’re going to get around that. We’re going to first create the Group Policy Object and then point the license tool toward the new GPO you just created. If we were to select “Yes” here right now, it’s going to pull up a list of all the Group Policy Objects that we have in the world. But we don’t have the licensing GPO yet. We didn’t create it yet.

Let’s go ahead and do that together. We’ll click “Cancel” here. We’ll go back into the GPMC where we know we can create Group Policy Objects. You have to be logged on with an account that can, in fact, create Group Policy Objects. I’ll just manually create one and call this “_PolicyPak Licensing File Demo.”

If we look at the “Settings” report, we’ll see it’s completely blank because I just created it one second ago. If we go back to the guy who is trying to perform the license injection, if we once again click “Create GPO” and say “OK,” once again it can’t create it because this guy doesn’t have rights. “Do you want to select existing GPO manually?” We’ll say “Yes.”

We will then pick the Group Policy Object that we just created. I called it “_PolicyPak Licensing File Demo.” Click “OK” here. Again, we’re still denied because this guy doesn’t have rights into the Group Policy Object. Let’s go ahead and manipulate the Group Policy Object itself here.

This is some heavy-duty stuff, but you click on the Group Policy Object itself. You click on the “Delegation” tab. You’ve got to give that guy, whoever that guy is, rights to create and edit this Group Policy Object. We’re going to click “Advanced” here, and we’re going to “Add” in that person. That guy’s name is “admin1.” We’re going to give him “Edit settings” rights against this particular Group Policy Object. Ten seconds ago he didn’t have rights; now he does have rights.

This wouldn’t be a problem at all if the person who was injecting the license file actually had rights in the first place. But now that this person – and I can prove that it’s the same guy – has admin rights, if we click “Create GPO,” it still won’t be able to create the Group Policy Object but we can now select it manually. We’ll go ahead and say “Yes” here.

We’ll click back on the Group Policy Object. Now this guy has rights inside this Group Policy Object. “License installed to the following GPO.” It’s saying, “You should manually link it to target scope!” What does that mean?

Well, at this point, this Group Policy Object is created in the “Group Policy Objects” node but not linked anywhere. If in your request you specify that you wanted the PolicyPak to work for your “West Sales Desktops” and your “East Sales Laptops” and your “East Sales Desktops,” that’s great. One has to get the license injected first.

Let’s take a look at what that looks like here now. See this? There we go. We can see our licensing data has been injected in there. All it’s doing is putting some registry settings in there. You’re linking it over to the place that you want PolicyPak to work, provided those are the places you said you wanted them to work when you sent us your license request key.

Let’s review. The reason that you’re getting this error in the first place is that this guy, whoever this is, doesn’t have rights to create and edit Group Policy Objects in the Group Policy Objects node. First things first, if you just log on as a domain admin, nine out of ten times this problem just goes away.

However, if you need to go to the advanced stuff, you can click on the Group Policy Object, click on “Delegation” and add in the person for edit rights in the Group Policy Object itself. Then you can inject the license file.

OK, there you go. This, again, will troubleshoot practically 100% of getting started with licensing with PolicyPak. I hope this helps. If you have any questions, we’re here for you.

Thanks so much.

  • 828
  • 04-Aug-2019