Windows Forum

Ask something
Discussion Locked

can't logon Win2K-local users prohibited

0 helpful
13 replies

by amosher

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Using Windows 2000 Server and Windows 2000 Professional
client.

We have a network where the servers are part of a domain but
the clients PCs
are not.? The users use applications through a Citrix server.

I had a need to map a network drive and the quickest way to do
it was to
join the client PC to the domain.? Copied over the files, then
deleted the
computer object through the Users and Computers AD app.?
After that, I could
not access the client PC.? Attempting to log into the local
machine results
in an error to the effect of 'The local policy of this system does
not allow
you to logon interactively".? And, after deleting the object, a user
can not
log into the domain.? The PC is inaccessible.

It appears that a vendor had set a group policy to disallow local
logins to
domain members except to specific users (who never had access
to this client).

Last Known Configuration did not solve the problem. Starting
up in Safe mode (without networking) results in the same
behavior.

So, how can I do one of two things:? either A.) alter the local
policy on
the client without being able to access it, or B.) rejoin the PC to
the
domain so I can apply a Group Policy?? Deleting or changing the
SID?

No user is currently able to log in to the PC, so anything with a
registry
key, or somehow capturing it with the domain controller?

Note: I reset the password of the local administrator with NT
password recovery but still does not get in. The PC is truly
inaccessible from the typical avenues. Not part of domain, local
users prohibited from logon.

Thanks!
Aaron

13 replies

by bfilmfan

It is obvious that the local security policy on the client systems in question is set to only allow certain users to interactively logon or access this computer from the network. When you joined the systems to the domain, the domain administrator has the rights to manage a computer object; thus, you had access.

Last Known Good Configuration and Safe Mode startups will not over-ride the local group policy object security.

And after you delete a computer object from a domain, of course, a user cannot use it to login to the domain. It is no longer a member of the domain.

My questions are:

What domain or workgroup were these computers originally memebers of? If the users are accessing the domain via Citrx, then they don't have to be members of the domain. They only have to have access rights to the Citrix server. Have you checked to see that the user accounts are in the correct security groups to access the Citrix server? Is the Citrix server still a member of the domain?

I would highly recommend that you NOT go into Active Directory and attempt to begin removing SID's. Unless you are extremely experienced
and know exactly the implications of the deletion, you are simply asking to rebuild Active Directory if you make a mistake.

by amosher

The users were not part of the domain and did access through Citrix. There were domain users defined in the GPO who could log in locally, but they were not ones defined locally.

It wasn't a question of the users being able to access Citrix - they literally couldn't even start working on the machine. Neither could the local administrator.

We fixed it by replacing the security hive in System32 with a copy from the repair directory.

by amosher

We fixed it by replacing the security hive in System32 with a copy from the repair directory.

by amosher

We fixed it by replacing the security hive in System32 with a copy from the repair directory.

by cg it

ya need to hack the local machine administrators account. There are ways to do that to reset the local machine administrators account [which will also tell you what the account name is].

by cg it

Theres been a number of articles on hacking the local machine admin account for windows XP and the principle is the same for W2K .There are some freeware programs to do this and some that cost $$. I've used the $$ one[s] and never had em fail.

by cg it

humm you should be able to get in after hacking the local admin account. The local policy applies in the absence of a domain controller in which to authenticate with.

If the computer is truly inaccessible but you need data off it, dual boot. Get the data, then reformat.

by amosher

Already reset the password for the admin account. It looks like the local policy applied, but the domain controller had written it while it was connected.

We fixed it by replacing the security hive in System32 with a copy from the repair directory.

by amosher

We fixed it by replacing the security hive in System32 with a copy from the repair directory.

by amosher

We fixed it by replacing the security hive in System32 with a copy from the repair directory.

by amosher

Alright, we fixed it. The local policy had been altered by the domain controller, and when the machine left the domain, the local policy of not allowing interactive logins remained.

There was no need to hack the admin account - I knew the password (had reset it to blank) but the local policy applied to teh local admin.

We replaced the security hive in system32 with the copy from the repair directory. Problem solved!

This discussion is closed to new replies.