Re: I really screwed up group policy this time...!

From: Nepatsfan (nepatsfan_at_SBXXXIX.com)
Date: 09/25/05 

Date: Sat, 24 Sep 2005 22:38:23 -0400

colinrei wrote:
> I was trying to lock down the system for my kids use,
> and ended up locking it down so tight I cant do anything
> now...
> can't shutdown, can't access Run, can't execute any registry
> modifications, etc.
> I disabled just about everything I could in gpedit.msc, I
> didn't think it would
> also affect the admin account!!
>
> How can I turn the policies off, at least for myself (admin)
> so that I can install software, and use the machine? Or am I
> doomed to do a full reformat/reinstall?
>
> I tried the registry script from kellys-korner "Lift
> MMC/GPEDIT Snap-In Restrictions". but since registry
> modifications are disabled I can't run it...
> help?
> --
> ~colin

Have you opened Windows Explorer, navigated to
C:\Windows\System32 and tried to run gpedit.msc from there?

How about starting in Safe Mode with Command Prompt and
entering gpedit.msc in the command prompt window?

Odds are you probably disabled your ability to do the following
but I'll pass it along anyway:

If you've turned off Simple File Sharing already then you can
skip these steps:
Disable Simple File Sharing.
Go to Start -> Control Panel and double click Folder Options.
Note: If you disabled access to Control Panel, you can try
accessing Folder Options through Windows Explorer's Tools menu.
Hopefully, you didn't block that route.
In Folder Options, click on the View tab.
Scroll down to the bottom and remove the check mark from the
box marked "Use simple file sharing (Recommended)".

With Simple File Sharing disabled you need to change
permissions on a folder.
Run Windows Explorer.
Navigate to this location:
C:\Windows\System32\GroupPolicy
Right click on the folder and select Properties from the drop
down menu.
Click on the Security tab.
Click on the Administrators group to highlight it.
In the Permissions box, change the Read setting, and only the
Read setting, to Deny.
Click OK.
You'll have to log off and log back on with your account for
the changes to take place.

Once you've logged back on, see if the policies you put in
place are still being applied to your account. Post back with
the results.

Note: Once you've applied the Deny Read permission for the
Administrators group you've got a new issue to deal with. You
can't run gpedit.msc. If you remove the Deny permissions from
the Group Policy folder to restore the ability to run the Group
Policy editor you may find some of the policies put into place
immediately putting you right back where you started. If that's
the case, then you may have no alternative but to reinstall
Windows.

Good luck

Nepatsfan

Relevant Pages

  • Re: MMC Message....
    ... that you may not have sufficient permissions. ... Login to an account which is a member of the administrators group. ... Find the box labeled "Use Simple File Sharing" ... Continuing on, Jim, as I suspected, Folder Options does not have a box ...
    (microsoft.public.windowsxp.basics)
  • RE: Uninstall IIS
    ... Go to tools, Folder Options ... unselect the "use simple file sharing" ... now you'll have the option to set permissions... ... This posting is provided "AS IS" with no warranties, and confers no rights. ...
    (microsoft.public.inetserver.iis)
  • Re: User levels
    ... disable simple file sharing through Folder Options. ... Permissions revert back to the NT/2K style then. ... >>I setup up a network in my house. ...
    (microsoft.public.windowsxp.network_web)
  • Re: Need Help with NTFS Permissions
    ... Folder Options, then I set the file permissions. ... I disabled simple file sharing and I've got the permissions set ... What else am I missing? ...
    (microsoft.public.windowsxp.network_web)
  • Re: Four days w/o a response-Sharing & Security & Phantom Drives
    ... professional has a component in admin tools that gives you access to set ... reset folder options when thru.As far as hd showing on start up,chk youre ... and use simple file sharing options, ... drives showing up whenever I boot, ...
    (microsoft.public.windowsxp.help_and_support)