Re: Locked out of Computer - "Deny logon locally = Administrator"

"Mister Gene" <MisterGene@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:F63686F5-F2A8-4F50-97B5-4ECE5B73A141@xxxxxxxxxxxxxxxx
Roger,

Thank you for your response. Since I have no network the drive was pulled
and is in a computer running Windows XP as D:\. This problem drive has
Windows 2000 on it. I have three (3) questions for you.

1. How do I access the NTFS security dialog?


Right click on the filesystem object, like the directory
system32\GroupPolicy, where you want to view and/or
change the NTFS permissions and select properties,
then go to the Security tab. In XP you may first need
to use Local Security Policy utility to change that XP
so it has the policy named Network access: Sharing
and security model . . . set to Classic (this is in Local
Policy Security Options, but you might only need this
when rehung on the XP).

2. How do I set a "Deny of Full for Administrators" on the directory
"system32\GroupPolicy".


It will probably be obvious once you see the dialog.

3. Is "gpedit" part of Windows 2000 and is it run from the "RUN" menu or
should I just go to the Admistrative tools - Local Security Policy and
change
it?


Both work for this if Local Security Policy was how you set
the problematic policy settings (gpedit show a superset).

Sorry for so many questions but I'm not a IT guy... LOL

Mister Gene


"Roger Abell [MVP]" wrote:

If you can access the boot drive of that system via the network,
such as by mapping c$ admin share, then do so. Otherwise you
will need to pull the drive and hang it as a secondary on the other
running system. Either way, once you can access the NTFS security
dialog, set a Deny of Full for Administrators on the directory
system32\GroupPolicy. If disk removal was needed, replace.
Reboot the system, log in as an admin, remove the Deny and then
immediately run gpedit and remove the offending policies.


"Mister Gene" <MisterGene@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:EDBE6FA8-07D9-43A2-89D4-0F4AF06AA303@xxxxxxxxxxxxxxxx
Please excuse the length of this post but I feel all the details might
be
necessary.
I have a computer that has Windows 2000 Professional Edition installed
in
it.

While adding a router to My home, I called My Internet Service Provider
because I was having a problem setting it up. The Tech found out that
My
cable modem had 2 IP addresses in it one of which was not theirs and
not
the
one for the router. He said that it looked like some other computer was
tapped into the modem on a remote connection. I explained to him that I
do
not connect to My computer remotely at all. He said that a hacker may
have
obtained access to My computer through that IP address.

After the Tech cleared out the modem, reset it remotely and helped Me
configure the router as a firewall, He suggested that I download and
install
from Microsoft the Microsoft Baseline Security Analyzer which he said
would
help protect the security of My computer even more. After downloading,
installing and running the MBSA it said that there was no Local
Security
Policy set on this computer.

Reviewing instructions I found at Microsoft's web site on how to
install a
Security policy, I picked one of the basic "*.inf" files and installed
it.
After opening the "Administrator tools", "Local Security Settings", and
then
"Local Policies" and then "User Rights Assignments", I did something
REALLY
dumb...

I set ALL the Policies to "Administrator"!!!

So... You guessed it I locked Myself out of the computer by the policy
"Deny
logon locally = Administrator". I have access to another computer that
has
XP
on it. I can take the hard drive from the one that has the problem and
install it into the one that has XP on it.

HELP!!! Is there any way to correct this???
(BIG Lesson learned here!!!!)

Mr. Gene





.

Relevant Pages

  • Re: Microsoft ME
    ... > I have just found out that the Microsoft ME operating ... > long on security to ME so I can keep people from using our ... How can I force people to use a login ID and password to log into my Windows ... Install all service packs and security fixes from Microsoft and otherwise ...
    (microsoft.public.security)
  • Re: lets vote for better security
    ... : OE-related security vulnerabilities. ... But there is no requirement to install and update every 30 to 60 days on any ... your argument would require every Windows computer to ... and yet WSH is still a threat. ...
    (microsoft.public.security)
  • Re: Safe?
    ... Q1) I got an email from Microsoft about a security update. ... A1) No. Microsoft NEVER sends emails with security update attachments. ... pages where you can access Windows Update, download patches, or request ... Services to install Windows security updates or hotfixes. ...
    (microsoft.public.security)
  • Group Policy Case Solved
    ... I began with the "Security Options" under the Computer ... I modified the group policy from my Windows XP Pro workstation using ... many more settings than Windows 2000 does; ...
    (microsoft.public.win2000.security)
  • Re: Will 839645 disable this?
    ... Check out the salary for Risk Analysis professionals. ... >> technology that is in those systems, still apply to Windows 2000. ... >> to install a security update in the offchance and likely remote ... Many security updates are NOT remote ...
    (microsoft.public.win2000.general)