After creating an OU (Organizational Unit) on a Windows Server 2003 computer, you attempt to assign an IPsec (Internet Protocol security) policy to the GPO of the new OU and receive the A constraint violation occurred error message.
This behavior will occur if:
- The OU is NOT fully replicated.
- The Windows Server 2003 computer that you are working on is NOT the PDC emulator.
- The Group Policy Object Editor snap-in connects to the PDC emulator and the Active Directory Users and Computers snap-in connects to the local DC.
To workaround this behavior, make sure that the Group Policy Object Editor snap-in and the Active Directory Users and Computers snap-in connect to the same domain controller.