Re: Group Policy - Locked myself out

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 02/11/04 

Date: Tue, 10 Feb 2004 23:26:14 -0700

x:Windows\System32\GroupPolicy
directory does exist, relative to your x:\.

When in the NTFS permissions editor you will see
two columns. One is of Grants, the other of Denies 

-- 
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
<anonymous@discussions.microsoft.com> wrote in message
news:e25a01c3effc$577ef140$a501280a@phx.gbl...
> 1) There is no GroupPolicy folder, only a gpedit Microsoft
> Common Console Document.
> 2) What is a Deny and how do I set one, and remove one?
>
>
> >-----Original Message-----
> >All you need to do is set a Deny of Full for Administrators on
> >system32\GroupPolicy folder.
> >Then, log off and back on as an admin, remove the Deny, and
> >use your tools to edit and reverse the troublesome policies.
> >
> >-- 
> >Roger Abell
> >Microsoft MVP (Windows Server System: Security)
> >MCSE (W2k3,W2k,Nt4)  MCDBA
> >"bigboon" <boon@IntuitionNYC.com> wrote in message
> >news:ced501c3ef48$b3e0e510$a301280a@phx.gbl...
> >> I set the Group Policy to lockout certain features (eg.
> >> Control Panel, Snap-Ins, etc), and acidentally locked my
> >> own admin account out as well, so now I can't go in and
> >> change anything, including the group policy b/c when I type
> >> gpedit.msc in the RUN command, I get an error message
> stating:
> >> The Snap-In below, referenced in the document has been
> >> resricted by policy. Contact your adminstrator for details.
> >> Group Policy
> >>
> >>
> >> HELP!!!
> >> thnx,
> >> boon@IntuitionNYC.com
> >
> >
> >.
> >

Relevant Pages

  • Re: Group Policy - Locked myself out
    ... All you need to do is set a Deny of Full for Administrators on ... Then, log off and back on as an admin, remove the Deny, and ... > I set the Group Policy to lockout certain features (eg. ... > Control Panel, Snap-Ins, etc), and acidentally locked my ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Run application on remote login
    ... Microsoft MVP - Terminal Services ... I mean there is only one group policy listed under the 'domainname'.local, then theres domain controllers, group policy objects,wmi filters ... When I went into advanced and think it was right click on administrator got up the box similar to rights over folders with allow and deny columns and clicked deny ...
    (microsoft.public.windows.terminal_services)
  • Re: Run application on remote login
    ... You want to deny "apply group policy" not read permissions. ... Microsoft MVP - Terminal Services ... "Jeff Pitsch" wrote: ... Add the Administrator account. ...
    (microsoft.public.windows.terminal_services)
  • Re: Locking Down TS Sessions
    ... On the Security tab of the loopback "lockdown" GPO you can check the Deny ... "Apply Group Policy" for Domain Admins. ... to be running some other software that the Administrator will have to ...
    (microsoft.public.windows.terminal_services)
  • Re: Best Way to Block user or computer from receiving GP
    ... Use of security group filtering (including Deny) leads to ... restructure of OUs (think of mobile devices - scatter them ... Group Policy 1 ... Group Policy 1 (deny Team Leads) ...
    (microsoft.public.windows.group_policy)