Re: Windows 2000 - Local policy - deny logon loccaly

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 02/11/04 

Date: Wed, 11 Feb 2004 07:12:52 -0700

Map the Admin$ or C$ share as an admin, then set a Deny
of Full for Administrators on system32\GroupPolicy in the
NTFS permissions. After this, log in as an admin, remove
the Deny, and edit the policy to get rid of the mistaken setting. 

-- 
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"Vladimir Benes" <benes@rsc.cz> wrote in message
news:%237AcHG97DHA.2472@TK2MSFTNGP10.phx.gbl...
>     Hello,
> I have this problem:  In Windows 2000 Proffesional, SP4, I have changed in
> Local policy settings -- deny logon locally. But, unfortunately, I
assigned
> there domain group "everyone", and now I cant logon neither normal user
nor
> LOCAL ADMINISTRASTOR!!!
>
> Can anybody help me please?
>
>

Relevant Pages

  • Re: MMC - admin locked out too
    ... just use the Deny trick to exempt ... from an admin account before it can edit policy, ... > Limit access to Regedit, MMC, command line, etc. & ... > restrict such items to Administrators only. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Moving DCs From Default OU ?
    ... if I'm an admin (domain admins, administrators, enterprise admin, ... etc) you can deny whatever you want to. ... although I don't have permissions I can change them back so I do ...
    (microsoft.public.windows.server.active_directory)
  • Re: Windows 2000 - Local policy - deny logon loccaly
    ... > Map the Admin$ or C$ share as an admin, ... > of Full for Administrators on system32\GroupPolicy in the ... > NTFS permissions. ... > the Deny, and edit the policy to get rid of the mistaken setting. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Windows 2000 - Local policy - deny logon loccaly
    ... > Map the Admin$ or C$ share as an admin, ... > of Full for Administrators on system32\GroupPolicy in the ... > NTFS permissions. ... > the Deny, and edit the policy to get rid of the mistaken setting. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: New Organizational Unit for a new remote office.
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... EVERY DOMAIN ADMIN IN THE FOREST ...
    (microsoft.public.win2000.active_directory)