Access Denied: Connecting to a DC to Edit a GPO

I've been monitoring changes made to Group Policy Objects (GPOs), and I've noticed that, apparently, only one of my two domain controllers (DCs) will write GPO change events to the Security event log. Regardless of where I make the change (i.e., on DC1, on DC2, or on a workstation), the log always shows that DC1 wrote the change, and the event shows up only on DC1. DC1 has several Flexible Single-Master Operation (FSMO) roles; is that why it's the only computer that tracks GPO change events?

FSMO roles don't come into play when you edit GPOs. You can edit a GPO's copy on any DC within the domain. The DC behavior that you describe is an indicator of which DC the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in happens to connect to. When you open the Active Directory Users and Computers snap-in on a DC, the snap-in doesn't necessarily connect to the local DC—it might connect to another DC on the network. To determine which DC you're connected to, check the computer name displayed in brackets beside the root in the treeview pane. For example, Figure 1 shows a connection to DC1.mtg.local. You can connect to a different DC in the same domain by right-clicking the root of the tree and selecting Connect to Domain Controller.