PoC for customer, fresh setup with 1 oes11sp2/sles11sp3, 2 dsfw, 1 win7sp1 client (joined to the domain) running win7sp1 rsat tools for aduc & gpmc. All latest patches for everything. All virtual, same esxi server, all running same ntp server.

I am trying to get group policies working (logged in as Administrator), & first thing I get when clicking on default domain policy is a popup error denoting permissions for this gpo in the sysvol folder are inconsistent with those in active directory. It is recommended that these permissions be consistent. To change the sysvol permission to those in active directory click OK. Clicking OK makes the error go away, but if you click away & back to default domain policy it comes back. I also noticed that when browsing default domain policy is blank, no settings at all, is that normal?

I then tried to import settings for cryptolocker blocker policies CryptolockerPreventionKit.zip & those are failing - the system cannot find the file specified when importing the actual gpo settings to the new gpo objects I created. WMI (.mof) filters *seem* to have imported correctly.

restarted both dsfw servers, the oes server, & win7 machine & tried again - same errors. Ran through dsfwguy's videos & novell tids for troubleshooting/testing dsfw on both servers & all the tests are coming back without error. ndsrepair -T shows time +/- 0, though sometimes I do see the oes server going to -1 according to the dsfw servers & the dsfw servers going to +1 according to the oes server. After this reboot when trying to launch gpmc.msc it now says The system cannot find the path specified, & repeats that on any GPO I click on. Followed 7005685 & was at least able to get back to the original popup error of the "permissions for this gpo in sysvol.....". I just hit cancel this time. It does it for the 3 cryptolocker gpo I created (or any new ones I try to create) as well as default domain policy. Does not seem to be "cosmetic" per 7011504 due to my not being able to import/work with GPOs.