Re: Admin / Domain Admin rights problem
From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 06/29/05
- Next message: Galen: "Re: Difference Between Delete and Delete SubFolders and Files"
- Previous message: Rob: "Difference Between Delete and Delete SubFolders and Files"
- In reply to: Andy Roxburgh: "Re: Admin / Domain Admin rights problem"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 29 Jun 2005 10:59:20 -0500
Make sure that you are logging on as the administrator account and not some
renamed administrator which is sometimes used as a domain account. The
command "net user administrator" will display group membership. Also verify
that domain admins is a member of the administrators group for the domain as
it is possible for it to be removed. You should also run a full malware scan
on your server being sure to use the latest definitions from your vendor.
Also some "protection" packages can block access to the registry I am told.
You may want to boot into safe mode to see if that helps. Subinacl is a tool
that can be used to view and change file and registry permissions at the
command line if need be. However it is very powerful and I would not use it
unless you have a full image type backup of your server or you are very
confident that you are using the right command possibly from trying it on a
test computer first. Group Policy can also be used to manage registry
permissions via computer configuration/Windows settings/security settings -
registry though you need to be careful doing such and should unlink the
Group Policy when done and needs to be linked to the proper OU where the
computer accounts are. Improper use of file/registry permissions via Group
Policy can cause performance problems in the domain. --- Steve
http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en
-- subinacl
http://www.jsifaq.com/SUBR/tip8700/rh8724.htm -- Group Policy to manage
file/registry permissions.
"Andy Roxburgh" <rallybob@hotmail.co.uk> wrote in message
news:uClPEQIfFHA.3936@TK2MSFTNGP14.phx.gbl...
> Actually I can't view the security settings - a message pops up telling me
> I
> can change them but not view them... except when I try to change them it
> won't let me do that either.
>
> So I can't see what accounts have full permissions!
>
> Andy
>
>
>
> "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
> news:uQCeGDCfFHA.1948@TK2MSFTNGP12.phx.gbl...
>> Evidently you can view the security settings on HKLM
>> Who/What account/group does have full permissions?
>> You will need to use an account that does have the ability.
>>
>> --
>> Roger Abell
>> Microsoft MVP (Windows Security)
>>
>> "Andy Roxburgh" <rallybob@hotmail.co.uk> wrote in message
>> news:uamLJ1$eFHA.744@TK2MSFTNGP14.phx.gbl...
>> > Hi,
>> > I'm using SBS2000 as my primary DC.
>> > I have a problem - the Administrator account cannot access 'HKLM' keys
> in
>> > the registry. I've been told it is because the Administrator is not a
>> member
>> > of the Domain Admins group. Except, accoring to SBS Admin console, it
> is.
>> > Furthermore I can't change the permissions for HKLM using the registry
>> > editor. I need to give the account access to HKLM but don't know what
> else
>> > to do - help!
>> >
>> > Thanks
>> >
>> > Andy
>> >
>> >
>>
>>
>
>
- Next message: Galen: "Re: Difference Between Delete and Delete SubFolders and Files"
- Previous message: Rob: "Difference Between Delete and Delete SubFolders and Files"
- In reply to: Andy Roxburgh: "Re: Admin / Domain Admin rights problem"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
