After creating an OU (Organizational Unit) on a Windows Server 2003 computer, you attempt to assign an IPsec (Internet Protocol security) policy to the GPO of the new OU and receive the A constraint violation occurred error message.

This behavior will occur if:

  • The OU is NOT fully replicated.
  • The Windows Server 2003 computer that you are working on is NOT the PDC emulator.
  • The Group Policy Object Editor snap-in connects to the PDC emulator and the Active Directory Users and Computers snap-in connects to the local DC.

To workaround this behavior, make sure that the Group Policy Object Editor snap-in and the Active Directory Users and Computers snap-in connect to the same domain controller.