Re: Save me from my stupidity

From: stefanT (stefanT_at_discussions.microsoft.com)
Date: 12/28/04

  • Next message: Jim Martin: "Re: O1 - Hosts: 64.91.255.87 www.dcsresearch.com" 
    Date: Tue, 28 Dec 2004 14:57:04 -0800

    OK. take #2

    I find I can access via the network after all. So I navigate to
    sysroot/sys32/GroupPolicy and set Deny on full for Administrators. I've not
    logged in locally yet so I give it a try. No joy. I reboot the machine and
    try again - still no joy. Same logon message - 'local policy does not permit
    interactive logon'. Any thoughts?

    What should the permissions be on this directory? Mine show
    Admins : allow unset ; deny unset
    System : allow unset ; deny unset
    Everyone : allow full ; deny unset

    The machine I'm working on was upgraded from W98 and the partition converted
    to NTFS afterwards. I've got another W2k-Pro machine which had a Fat32
    sysroot partition. I've just converted that to NTFS and that shows the same
    permissions as well. Somehow, though, it doesn't feel quite right to have
    full permissions for Everyone and no permissions for Admins or System.

    StefanT

    "stefanT" wrote:

    > Well and truly - grabbed by the short and curlys.
    snip....
    >
    > StefanT
    >
    > "Roger Abell" wrote:
    >
    > > Hmmm, got bitten a little by that one ? At least we can get
    > > you out of it, and it is likely one of the worst, for a machine
    > > that is not a domain controller, that one can accident upon
    > > while tightening a machine. Just remember that deny always
    > > overrules a grant, and the Users, Authenticated Users, Everyone,
    > > Network, and Interactive have wide impacts.
    > >
    > > OK, so you need, as an admin, to locate your folder permissions
    > > at system32\GroupPolicy and there set a Deny of full for the
    > > Administrators group. Then, log off and back on, remove the
    > > Deny you just set, and then immediately edit the local security
    > > policies to remove the problem setting.
    > > At a cmd prompt force refresh of policy (at prompt enter secedit
    > > and go to the How to . . . refresh ), then log off and back in to see
    > > if you are now set to go.
    > >
    > > --
    > > Roger Abell
    > > Microsoft MVP (Windows Security)
    > > MCSE (W2k3,W2k,Nt4) MCDBA
    > > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
    > > news:C3BF937E-61C3-4DE7-9930-F7E6449BF071@microsoft.com...
    > > > After being given "Hardening Windows Systems" for Christmas I decided to
    > > play
    > > > about with the local policy settings on my networked W2k Pro machine.
    snip...
    > > > StefanT
    > >
    > >
    > >

  • Next message: Jim Martin: "Re: O1 - Hosts: 64.91.255.87 www.dcsresearch.com"

    Relevant Pages

    • Re: Moving DCs From Default OU ?
      ... if I'm an admin (domain admins, administrators, enterprise admin, ... etc) you can deny whatever you want to. ... although I don't have permissions I can change them back so I do ...
      (microsoft.public.windows.server.active_directory)
    • Re: how to restrict users to search in their own Organizational Unit
      ... I also want to say that in fact you shouldn't deny the read permission to anyone and this scenario the MOSS Administrators or who is responsible for Add users to Your Sites should be carefull when performing this action. ... Now, because you're dealing with many users, my recommendation is to create THE NECESARY Security Groups in each OU and related them with your MOSS2007 existing security groups, in future when someone creates some user, you just have to add that user to the necessary group and that user will be given the necessary permissions. ... decided a script can make it possible to accomplish, ... > If I need to create a security group per OU and then add all users ...
      (microsoft.public.windows.server.active_directory)
    • Re: MMC - admin locked out too
      ... I probably should have added that the Deny is used here ... granted to Administrators would also do this, ... and granted permissions for all of those other accounts. ... > the Deny column for the Full Control line. ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Permissions problems
      ... Yes administrators can be members of the users group and certainly will be ... Instead of deny permission just ... remove those permissions that you do not want the groups to have. ...
      (microsoft.public.windowsxp.security_admin)
    • Re: Share Permissions: Deny behaviour
      ... Deny overrides all other permissions. ... There are two types of Deny (again goes for share and NTFS). ... explicit allow permission, then you're stuck with implicit deny. ...
      (microsoft.public.windows.server.general)