The User accounts cannot be added into GroupPolicy ‘AllSBSUsers’ SBS 2011

I began seeing this error on a migrated SBS 2011 Standard server in the event log Microsoft-Windows-Small Business Server/Operational section

In order to identify what originally happened in the migration, I went to C:\Program Files\Windows Small Business Server\Logs and viewed errors.log file. In this file, it showed ConfigureGP: Windows Small Business Server group policies cannot be configured. This was a good clue that this part of the migration got messed up. It is quite similar to the issue talked about on the official SBS Blog site

How to Manually Create the SBS 2008 and WSUS Group Policies Objects at http://blogs.technet.com/b/sbs/archive/2009/09/03/how-to-manually-create-the-sbs-2008-and-wsus-group-policies-objects.aspx 

To fix the issue, follow the instructions on that site except the difference here is that this is a SBS 2011 server and that blog entry was written for SBS 2008. Instead of using the file gpofix.txt that is listed on that site, use the updated SBS 2011 file you can download here

I suggest before doing this, to backup your GPO’s, WMI filters and delete these GPO’s and WMI filters as they will be recreated with this script. if you don’t know how to backup your GPO’s, check out this site http://www.petri.co.il/backing-up-group-policy-objects.htm 

When you run this updated script, it will create the following Group Policies objects

• Windows SBS Client – Windows 7 and Windows Vista Policy
• Windows SBS Client – Windows XP Policy
• Windows SBS Client Policy
• Windows SBS CSE Policy
• Windows SBS Users Policy

In addition, 3 WMI filters will be created

• Windows SBS Client
• Windows SBS Client – Windows 7 and Windows Vista
• Windows SBS Client – Windows XP

Everything else on the Official SBS Blog site is the same. To confirm that it was applied correctly, take a look at your Group Policy Manager and you will see the newly created ones with the current date and time.

Of course if you want to see even more details, open the file GPOTask.log at C:\Program Files\Windows Small Business Server\Logs and you can see each action that was taken. If you are not aware of this folder and logs, it is one of the standard places I look on a SBS 2008 or SBS 2011 server when troubleshooting SBS related issues.