I know this error is infuriating—you're just trying to tweak a policy, and Windows throws this cryptic stop sign. Let's get you moving.
The Quick Fix
You're seeing ERROR_SHARED_POLICY (0x0000201A) because the Group Policy Object (GPO) you're editing is shared across multiple domains or sites. Windows forbids changes to shared policies from anywhere but the root domain. Here's how to fix it now:
- Open Group Policy Management Console (GPMC) on your domain controller (Windows Server 2019 or 2022).
- Navigate to the GPO that's throwing the error. You'll likely see it listed under Group Policy Objects but grayed out or with a warning icon.
- Right-click the GPO and select Properties.
- Go to the General tab. Look for the Sharing status. If it says
This GPO is shared
, you need to unshare it first. - To unshare, use
ADSI Edit(Windows Server 2022) ordsquerycommand line. I prefer the command line because it's faster. Run this on the root domain controller:
dsquery * "CN=Default Domain Policy,CN=System,DC=YourDomain,DC=com" -attr gPCMachineExtensionNamesFind the gPCSharedPolicy attribute. If it's present, delete it using ADSI Edit:
- Open ADSI Edit, connect to Configuration naming context.
- Browse to
CN=Services,CN=Microsoft,CN=GPO,CN=YourGPO. - Delete the
gPCSharedPolicyattribute. Confirm. - Back in GPMC, right-click the GPO and choose Edit. The error should be gone.
Important: This only works if you're the domain admin. If you're not, you'll need to request changes at the root.
Why This Works
The error code 0x0000201A translates to The policy object is shared and can only be modified at the root.
In Active Directory, shared policies are usually created when you use Advanced Group Policy Management (AGPM) or when policies are copied across domains. The root domain holds the master copy. Windows blocks edits elsewhere to prevent conflicts. By removing the sharing attribute, you're telling the system, I own this now.
It's a blunt fix, but it works when you need to make changes fast.
Less Common Variations
When AGPM Is in the Mix
If you're using Microsoft Advanced Group Policy Management (AGPM), the error can pop up when you try to edit a GPO that's checked out to someone else or not in production. Check the AGPM Change Control node in GPMC. If the GPO is Checked Out
or Pending Check-in
, you can't modify it. Contact the user who has it locked or delegate changes through AGPM.
Policy Inheritance from Parent Domain
Sometimes the shared flag comes from a parent domain, especially in a tree structure. For example, if you have corp.example.com and child.corp.example.com, a policy created at the root can be shared down. In that case, you can't unshare it from the child domain. Workaround: Create a new, unshared GPO in the child domain with the settings you need, then disable the inherited shared GPO.
WMI Filter Conflicts
Rarely, a WMI filter attached to the GPO can cause this error if the filter references a shared object. Unlink the WMI filter temporarily, edit the policy, then reapply the filter. Test this in a dev environment first.
Prevention
To avoid this error in the future:
- Always create new GPOs locally in each domain instead of copying or sharing them. Use Group Policy Preferences for cross-domain settings.
- Limit AGPM usage to controlled environments. If you don't need change control, skip AGPM—it adds complexity.
- Document shared policies using a simple spreadsheet or internal wiki. Note the root domain and any dependencies. When you need to modify one, know exactly where the root is.
- Use least-privilege access for GPO editing. Only domain admins should edit shared policies. Everyone else gets delegated permissions on unshared copies.
- Test in a lab before unsharing a policy. Removing the shared flag can break links across domains. I've seen it cause policy replication failures in production. Always back up the GPO with
Backup-GPOin PowerShell first:
Backup-GPO -Name "YourGPO" -Path "C:\GPOBackups" -Comment "Before unsharing"That's it. The error is annoying, but once you know the root cause, it's straightforward. You've got this.