Windows Forum

Ask something
Discussion Locked

GPO: Control Panel Lockout

0 helpful
6 replies

by jeaster

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
While messing around on my test domain, I managed to lock all users/Administrators out of Control Panel. I have disabled all GPOs at LS,D,OU, but still cannot get into it with an Admin account. ANy suggestions on how to fix this, or at least track down the problem? I have learned, however, that before a GP is implemented, to make sure that is is NOT applied to ANY Domain Admins.

6 replies

by ewgny

It's not good enough to just remove a policy in some instances (Obviously). What you need to do is to apply a new Group policy that is configured to "disable' The "Disable control panel" policy.
That should snap things back into place.
Remember, never modify the default domain policy
(except for your password policies), or your default domain controller policy. Instead create sepeate policies to apply at those levels.

by cg it

Group Policy refresh interval [default] I believe is 90 minutes. What you can do is reset the GP, log off and then log back on or reboot the PDC. That should apply the GP immediately to all clients who then log on.

by jeaster

Shortly after posting this question, I remembered that MS has made a utility called gpresult.exe, which allows you to see the policies that have been applied to a PC/account on login. I ran that, and was able to specifically check each applied policy. As I had stated, I had disabled (not delelted) each policy. However, I had accidentally changed this setting in the local GPO, and not the AD GPO. After executing MMC, and adding the Local GPO snap-in, I was able to change the policy back to the default. Good thing this was my test domain.

This discussion is closed to new replies.