Re: Domain Policy

First from the server you can access the registry remotely see if you can
manage Group Policy remotely to undo your changes. While on that server
enter MMC in the run box to open Management Console and then add the Group
Policy Object Editor and instead of local computer select another computer -
browse and browse for and select the domain controller and you may then be
able to edit domain level Group Policy.

If that does not work use the registry editor. You are not looking for the
policy itself but you want to edit/remove the registry keys that are locking
you out to give you a change to then edit Group Policy to remove those
settings. You want to look for registry keys/entries under
HKCU\Software\Policies\Microsoft\Windows such as system where if you see
DisableCMD you want to delete that dword entry. Under
HKCU\Software\Policies\Microsoft\Windows\MMC if you see any items listed
{numbers and letters}either remove the {numbers and letters}or change the
restrict run values to 0. After that you should be able to open access ADUC
and edit Group Policy though you may need to logoff/logon the domain
controller or reboot the server first.

Group Policy enforces those registry settings and the next time Group Policy
is applied those registry entries will return which is why it is important
that you edit Group Policy ASAP after gaining access starting with those
settings that locked you out..

Steve


"Shabbir Jadliwala" <ShabbirJadliwala@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message news:541A33B4-26D2-4E3D-9859-943BE629B265@xxxxxxxxxxxxxxxx
Hi Steven,

I can't get on the Registry locally on the server as well. But can do it
remotely from another server, which is not a Domain Controller. I tried
searching my policy in there, but couldn't find it in there. Is there any
other place I can find it?

Thanks for your help.

Best Regards,

Shabbir

"Steven L Umbach" wrote:

Try logging onto a domain computer [non critical workstation] as domain
admin and see if you can run regedit or if you can run a tool called Dial
a
Fix from a flash drive or such as it can detect and remove many Group
Policy
restrictions. If that works then you can use MMC snapin for Group Policy
to
manage the Group Policy on a domain controller to make changes to undo
the
harm. Otherwise if you can use regedit look for and delete the Group
Policy
restrictions seen under the keys listed below which will buy you time to
make changes to Group Policy.

Steve

http://www.softpedia.com/get/System/System-Miscellaneous/Dial-a-fix.shtml
-- Dial a fix

Table 1 Approved Registry Key Locations for Group Policy Settings

For Computer Policy Settings: For User Policy Settings:
HKLM\Software\Policies (The preferred location)
HKCU\Software\Policies (The preferred location)

HKLM\Software\Microsoft\Windows
\CurrentVersion\Policies
HKCU\Software\Microsoft\Windows
\CurrentVersion\Policies



"Shabbir Jadliwala" <Shabbir Jadliwala@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote
in
message news:733AF4FD-9341-47EB-8363-EC442BA03A66@xxxxxxxxxxxxxxxx
I have had set up a policy to block all users with any rights other then
the
basic ones. But by mistake I have had applied to all, instead of the
group,
and now I can do any changes to it myself, even though I am logged in
as
the
Administrator.

Is there any way, I can get it reset back to original. I don't have
access
to my local drives or command prompt or AD or anything right now.

Any help would be really appreciated.

Best Regards,

Shabbir





.

Relevant Pages

  • RE: Several Problems; how to reset security and troubleshoot serve
    ... Security Templates in Windows Server 2003 - ... The Network Service account must be added to the policy settings in the ... This issue may occur if Group Policy settings that were applied at ... When you tried to launch the Remote assistance, ...
    (microsoft.public.windows.server.sbs)
  • RE: WSUS 3.0
    ... we need to configure a DWORD registry on the client. ... "Does this port need to be added in the group policy object where I ... specify the URL of the server?" ...
    (microsoft.public.windows.server.general)
  • Re: Remote Desktop
    ... group policy you can create a separate organization unit on the domain and ... Try the registry first, it should work. ... server) without affecting other servers. ... It will also no allow you to enable Offline files, ...
    (microsoft.public.windows.server.general)
  • Re: Group Policy Error - Parameter Incorrect
    ... Go into the registry on the server. ... then open group policy editor and change it in there. ... > It then opens the Group Policy Object Editory, however it just has a red X> on the root of the tree on the left pane. ...
    (microsoft.public.windows.group_policy)
  • Re: Admin / Domain Admin rights problem
    ... As far as Group Policy - registry you will not see that in Local ... >> Key and SubKey - Type of Access: ... >> Detailed Access Flags: ...
    (microsoft.public.win2000.security)