Re: Admin User Accounts - privilages lost

What may help is a couple of free tools from SysInternals called regmon and
filemon. You can logon as one of the problem users and run regmon and
filemon and then look in the log for those for access denied entries which
could help you track down where permissions are lacking and then make
adjustments though usually running secedit as per KB will reset registry
permissions. --- Steve

http://www.sysinternals.com/Utilities/Regmon.html --- regmon and link to
SysInternals

"Matthew Lemin" <MatthewLemin@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:EEC71C72-3A91-4798-89EC-3E4433160E53@xxxxxxxxxxxxxxxx
The affected users were only members of the Administrators group. Used
the
management console to change accounts - to no avail. Tried the Secedit
fix
but that did not work either. There appears to be nothing wrong with the
Administrator group per se, just the particular users. I suspect a
strange
acl problem, but I don't have the knowledge or time to track that down.

Anyway, I went down the route of creating new users with Administrator
privilages and copying across the desktop items, Favourites, My
Documents,
Outlook files etc. A total bore but it worked! Thanks for your help
anyway.

"Steven L Umbach" wrote:

Use the command net localgroup administrators to make sure it shows that
these users are indeed members of the administrators group. Also make
sure
that they are not members of the guests group. Keep in mind that if those
user accounts have deny permissions defined in an access control list
[registry or file] that the deny permissions will override their allow
permissions though that would not be the case by default. It may help to
use
the secedit command as shown in the link below to restore security
settings
to default defined levels in case they got messed up somehow. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;313222

"Matthew Lemin" <MatthewLemin@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:A4FD0A22-AFD3-449E-92F1-E5A670AC10E1@xxxxxxxxxxxxxxxx
Windows XP Professional SP2 - fully patched.

When I installed XP I created two Administrator accounts and three
limited
user accounts.

For some reason the administrator accounts appear to have lost the
ability
to change the registry. Some programs will now not install, or come up
with
"fatal errors". Adobe Acrobat keeps asking me to register even though
I
tick
the box telling it not to ask me again. I can, however, run regedit
and
make
manual changes to the registry.

The accounts show up as "Administrators" in the User Accounts
application
in
control panel.

I have logged in as the main system administrator and this does not
have
the
problem - it has all the usual administrator privilages.

I have tried changing the Accounts to Limited and back with reboots in
between and this has made no difference. I have run full virus and
spyware
scans using up to date full copies of AVG and spyware doctor to no
avail.

Any suggestions as to how this might be fixed?
I want to avoid creating new accounts if this can be avoided.





.

Relevant Pages

  • Re: Security Group Keeps getting removed???
    ... ACL on all security principals (users, groups, and machine accounts) present ... Delegated permissions are not available and inheritance is automatically ... AdminSDHolder Object Affects Delegation of Control for Past Administrator ...
    (microsoft.public.windows.server.active_directory)
  • Re: installing games so other users can access and save their game
    ... YES BUT I BOOTED IN TO SAFE MODE AND SIGNED ON AS ADMINISTRATOR AND RESET ... ALL ACCOUNTS TO FULL RIGHTS ADMINISTRATOR AND THEN INSTALL WORKED FINE (IT ... ALL THE ACCOUNTS GET THE ERROR AGAIN THIS ERROR DOESN'T HAPPEN WITH ALL ... ALL ACCOUNTS ARE SUPPOSED TO HAVE PERMISSIONS OVER EVERYTHING ...
    (microsoft.public.games)
  • Re: 0x80070005 / _Inventory: Installer returned 0x5 (5)
    ... |> Access Denied is a hard one to determine where the keys are failing - ... Navigate to the following key in the registry: ... and then click Permissions. ... |> For Administrator and System, select the Allow check boxes next to Full Control ...
    (microsoft.public.windowsupdate)
  • RE: services running in windows domain (winXP clients)
    ... registry changes and permissions. ... i mean if someone is administrator can change the ... (Maybe create a group policy setting this ...
    (Focus-Microsoft)
  • Re: (plz read Jupiter Jones) Adminstrator/Limited User Security Issues
    ... If the users are Limited Users, all accounts have their own passwords, ... file system is NTFS and Administrator sets permissions. ... Then set permissions and no one should be able to change the ... > administrator account be able to allow/disallow security ...
    (microsoft.public.windowsxp.security_admin)