IT Employment

Ask something
Discussion Locked

Default domain policy

0 helpful
2 replies

by fx.king

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi

I've managed to disable use of mmc's and the run facility (among others)by using the default domain policy, not realising it would apply to administrators - which obviously it does.

I cannot get into active directory users and computers to change the policy.

Has anybody got any ideas as to how I can bypass/change this policy - without re-building the server?

Many thanks

Fran

2 replies

by difster

1. Connect to the machine from another W2K system on the
network. At a DOS prompt:
net use \\ /u:\

For example:
net use \\computer1 /u:computer1\Administrator password1

2. Create new admin user on the remote system you need to
fix:
Open Start-Programs-Administrative Tools-Computer
Management
Select 'Action-Connect to another computer' from the menu
and connect to the remote system
User 'Local Users and Groups' under Computer Management to
create user (say 'GPDeny') with Administrator rights

3. Set permissions on c:\winnt\system32\grouppolicy to
deny access to the GPDeny user you just created:
Open \\\c$\winnt\system32 folder on remote
computer and make hidden folders viewable through Tools-
Folder Options menu.
Edit security on GroupPolicy folder to add GPDeny user
with Deny access selected for all permissions.

4. Log on locally to the system you are fixing as GPDeny
and run mmc with permissions of another admin account that
does have access to the GroupPolicy folder using
the 'RunAs' utility:
Logon as GPDeny and open DOS prompt then run:
runas /user: mmc
For example
runas /user:Administrator mmc

This discussion is closed to new replies.