Re: User Rights Assignment - not available
- From: "Tim Munro" <Excelsior@xxxxxxxxxxx>
- Date: Sun, 26 Feb 2006 11:08:51 -0500
Further info:
I cannot access in any way the following keys:
HKLM\Security\Policy\Secrets\
SAC
SAI
SCM:{93D25335-A2CB-441C-AA1A-127874B1F2DB}
SCM:{C36729C6-65AB-4A6F-8B96-53FF94E3A8D2}
I get "Cannot open <key>: Error while opening key."
--
Tim
"Tim Munro" <Excelsior@xxxxxxxxxxx> wrote in message
news:eOK0p0uOGHA.3924@xxxxxxxxxxxxxxxxxxxxxxx
No go.
Here's the top of the log file created:
-------------------------------------------
Sunday, February 26, 2006 10:47:44
----Configuration engine was initialized successfully.----
----Reading Configuration Template info...
Event audit settings are turned off.
----Configure User Rights...
Warning 2: The system cannot find the file specified. <--- what file?
Error enumerating info for Accounts from LSA. <----- this bothers me.
Configure S-1-5-20.
Configure S-1-5-19.
Configure S-1-5-32-551.
Configure S-1-5-32-544.
Configure S-1-1-0.
Configure S-1-5-32-545.
Configure S-1-5-32-547.
Configure S-1-5-21-1060284298-329068152-839522115-501.
Configure S-1-5-32-555.
User Rights configuration was completed successfully.
"Steven L Umbach" <n9rou@xxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:KuOdnQwyzqHHFJ3ZRVn-vg@xxxxxxxxxxxxxx
Weird. There are free tools from SysInternals called filemon and regmon
that if you start them just before you try to run something and then stop
them from logging when the action fails you may find helpful information
in the log for access denied entries that would indicate something you do
not have necessary permissions for. I use them quite a bit and find it is
helpful to add access denied to filter view to highlight as there could
be thousands of entries in the log. The link below is to regmon and
filemon.
http://www.sysinternals.com/Utilities/Filemon.html
http://www.sysinternals.com/Utilities/Regmon.html
Another thing you could try is to use the secedit command to try and
restore security settings to default defined levels which may help per
the link below. You can simply copy and paste the command to run as it
is. --- Steve
http://support.microsoft.com/default.aspx?scid=kb;EN-US;313222
"Tim Munro" <Excelsior@xxxxxxxxxxx> wrote in message
news:OPXQhEiOGHA.2064@xxxxxxxxxxxxxxxxxxxxxxx
I went through both the integrity check and did a repair anyway.
Result is the same. I'm guessing here that this may be a permissions
problem. Everything else on the "Local Policy" mmc is accessible and
changeable. It's just the "User Rights Assignment" that is bad.
When I went to rebuild (copying and renmaing as the article suggests)
I did get the access denied. Unfortunately "Import Template" was greyed
out when I used the filename secedit.sdb. Any other name and it was
fine.
Is there somewhere in the registry I can check for permissions that
might be causing this behaviour?
Thanks
--
Tim
"Steven L Umbach" <n9rou@xxxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:8OidnU6airjcPGLenZ2dnUVZ_vudnZ2d@xxxxxxxxxxxxxx
Hmm. It sounds like you may have a corrupt secedit.sdb file. See the
link below for two possibilities of which one is to attempt a repair
with esentutl and the other is a rebuild. --- Steve
http://support.microsoft.com/?kbid=894351
To resolve this issue, first run the Esentutl.exe tool to examine the
integrity of the Secedit.sdb database. To do this, follow these steps:
1. Click Start, click Run, type cmd, and then click OK.
2. At the command prompt, type the following command, and then
press ENTER:
esentutl /g Drive:\WinDir\security\database\secedit.sdb
Note In this command, Drive is the hard disk drive where Windows
XP Professional is installed, and WinDir is the folder where Windows XP
Professional is installed.
After the Esentutl.exe tool finishes, use one of the following methods
to resolve the issue, depending on the message that the Esentutl.exe
tool returns: . If the Esentutl.exe tool returns the following message,
use Method 1 to resolve the issue:
This operation may find that this database is corrupt
. If the Esentutl.exe tool returns information that is similar to
the following message, use Method 2 to resolve the issue:
Microsoft(R) Windows(R) Database Utilities
Version 5.2
Copyright (C) Microsoft Corporation. All Rights Reserved.
Initiating INTEGRITY mode...
Database: L:\WINDOWS\security\database\secedit.sdb
Temp. Database: TEMPINTEG2680.EDB
Checking database integrity.
Scanning Status (% complete)
0 10 20 30 40 50 60 70 80 90 100
|---|---|---|---|---|---|---|---|---|---|
...................................................
Integrity check successful.
Operation completed successfully in 0.841 seconds.
Note When you run the Esentutl.exe tool, your computer is returned to
the original installation state where the Local Security Policy is not
defined. You may have to start your computer in Safe Mode to rename
files or to move files. To start your computer in Safe Mode, press the
F8 key while Windows XP Professional is starting, type 1 to choose Safe
Mode from the startup options, and then press ENTER.
"Tim Munro" <Excelsior@xxxxxxxxxxx> wrote in message
news:uOKPnsWOGHA.2124@xxxxxxxxxxxxxxxxxxxxxxx
Hello all,
On my local PC (Windows XP SP2), in "Local Security Settings>Local
Policies>User Rights Assignments" I get "Windows cannot read template
information". Any idea what happened and/or how to get this back?
--
Tim.
.
- References:
- User Rights Assignment - not available
- From: Tim Munro
- Re: User Rights Assignment - not available
- From: Steven L Umbach
- Re: User Rights Assignment - not available
- From: Tim Munro
- Re: User Rights Assignment - not available
- From: Steven L Umbach
- Re: User Rights Assignment - not available
- From: Tim Munro
- User Rights Assignment - not available
- Prev by Date: Re: csrss.exe and Disabled Security Center
- Next by Date: Re: User Rights Assignment - not available
- Previous by thread: Re: User Rights Assignment - not available
- Next by thread: Re: User Rights Assignment - not available
- Index(es):
Relevant Pages
|
