Windows Forum

Ask something
Discussion Locked

Default Domain Policy

0 helpful
7 replies

by izz

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I know I did something wrong, but I hope there is a solution. Here is what happened: In the security section of the Default Domain Policy, I only gave permission to the Users/Builtin and removed all others, now I can not modify this policy cause even admins do not have permission. Is there anyway other than the System state restore, like registry or something, please any help would be appreciated.

7 replies

by scottfrancis

Have a look at this. It worked ok for me

Reseting the User-rights Assignments for the Default Domain GPO
Edit the Gpttmpl.inf file to reset the default user-rights settings. Note that the default path for the Sysvol folder is %SystemRoot%\sysvol, and the Gpttmpl.inf file is located in the following folder:
sysvol path\Sysvol\ domain name\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\Machine\Microsoft\Windows NT\SecEdit
WARNING: Before you perform the following steps, you should make abackup of the Gpttmpl.inf file.

NOTE: The permissions settings you will have after you perform the following procedure are identical to permissions that are compatible with pre-Windows 2000 users and permissions that are compatible only with Windows 2000 users.

To completely reset the user rights to the default settings, replace the existing information in the Gpttmpl.inf file with the following default user-rights information that you can copy and paste into the appropriate section of your current Gpttmpl.inf file:
[Unicode]
Unicode=yes
[System Access]
MinimumPasswordAge = 0
MaximumPasswordAge = 42
MinimumPasswordLength = 0
PasswordComplexity = 0
PasswordHistorySize = 1
LockoutBadCount = 0
RequireLogonToChangePassword = 0
ForceLogoffWhenHourExpire = 0
ClearTextPassword = 0
[Kerberos Policy]
MaxTicketAge = 10
MaxRenewAge = 7
MaxServiceAge = 600
MaxClockSkew = 5
TicketValidateClient = 1
[Version]
signature="$CHICAGO$"
Revision=1
Note that the preceding information is the default Gpttmpl.inf contents, and you must save the changes to the Gpttmpl.inf file after you alter it.
Increment the group policy version to ensure that the policy changes are retained by opening the Group Policy editor, making a change, then closing the Group Policy editor. The Gpt.ini file controls the Group Policy Template version numbers. To manually increase the group policy version, perform the following

by izz

I tried this actually, but what I need is something similar to "Take Ownership" of the Default Domain Policy, cause when I access it from the mmc, it says "Access Denied"

by techkid

can you not even make your administrator part of the users/built-in group? If I'm understanding this right, if the Administrator is part of that group you'd be able to change the setting back.

by izz

the administrator is already a member of that. But the thing is that container does not have full control over that policy. I need like a take ownership tool to do what I have in mind

by acattr

You can remove the default policy files.

Policies are kept on domain controllers under C:\WINNT\SYSVOL\sysvol\domainname.com\Policies

Try moving the files out. Considering the default policy contains nothing but default settings. You can remove the subfolders under policies and recreating them.

This discussion is closed to new replies.