Windows 2003 Problem with Group Policy for Services Startup and Permissions
- From: mike.hubenschmidt@xxxxxxxx
- Date: 27 Apr 2006 04:27:35 -0700
We just finished assisting microsoft with an issue that I feel needs to
be put out there due to lack of information on the topic. Even though
its a unique scenario. In a nutshell here is the problem.
All of our windows 2000 workstations in our enterprise lost their
ability to have the local system accounts (interactive, network
services, and system) from manipulating certain services. This stopped
us from installing programs or making changes to the system that
require these permissions. The main one being the latest version of
SMS 2003 SP2 client. It would not finish the unattended install due to
a permissions error on the 2000 workstations.
We did originally have a domain level policy that removed everyone's
rights to stop, or change the BITS, Automatic Updates, Netlogon, and
SMS host services. But knowing that this existed, we disabled it by
using several means, starting with unchecking the services inside the
policy and ending with deleting the policy from the Domain completely.
We forced the updates on the workstations with enforce, made many
reboots, etc etc etc. To no avail we were still having problems. I
then thought hmm, a possible dare I say "anomaly?". I created a brand
new policy and reconfigured the affected "services" and manually added
all the permissions back. BOOM, all was well.
SO here is the bottom line if you remove or modify the permissions via
a 2003 group policy, push it out to all your clients, and then disable
said policy, the ACL's/Perms for the services stay and do not get
reverted back to their defaults until a new one is pushed. As you can
see, this could potentially be VERY detrimental in an enterprise and
extremely difficult to diagnose. Microsoft is testing it now to
recreate the issue for a specific resolution path.
Enjoy.
.
- Prev by Date: Re: Security of a Windows 2003 VPN Question
- Next by Date: Re: Start and Stop Services Remotely Under Non-Administrative User
- Previous by thread: Re: Security of a Windows 2003 VPN Question
- Next by thread: Problems with authentication and using alias to the local machine
- Index(es):
Relevant Pages
|
|
