Computer admin question

[bogboy1978]

Is it possible to be logged into Win XP as administrator but still have only limited ability to do things? I ask because I am unable to do several things that I used to be able to do. I have only one user account on the PC and it is as admin (I believe it has to be when there is only one account anyway) but I am suddenly unable to start or stop services, although I can choose to disable them entirely. I cannot stop or configure system restore as it is greyed out and I am told it is to do with a group policy. I also had to boot into safe mode to install Diskeeper 9.0 because windows would not allow the program to start it's service or any of the others it needed. I have coped for a short while with it been like this, but it is now so bad I cannot even install things like Morrowind, which doesnt have to configure anything.

I am hoping someone can help as I hate been logged in as the one and only admin, yet having no rights to do anything. And just to let you know I am using winXP home and therefore anything like using gpedit.msc is a no go.

Thanks in advance.

 

[bcastner]

Download, and intall the Windows 2003 Resource Kit:

http://www.microsoft.com/downloads/...69-57FF-4AE7-96EE-B18C4790CFFD&displaylang=en

The purpose of this is to have access to the tool NTRIGHTS.EXE

Some XP OEM images are shipping missing some necessary rights, I do not know why. What Home also lacks is secpol.msc to provide a GUI interface to correct the issue. (MSFT is aware of the problem).

. NTRIGHTS uses case sensitive rights names, so be carefull typing them.

. Go through all the shown rights in the link I will now provide, and one by one use NTRIGHTS to restore that rights assignments, as follows:

ntrights +r SeNetworkLogonRight -u Adminitrator

For the situation in which it is a SeDeny.... right:
ntrights -r SeDenyServiceLogonRight -u Administrator

See:

http://support.microsoft.com/kb/279664/EN-US/

 

[bogboy1978]

Sounds complicated, but I will give it a shot, thanks.

 

[bcastner]

It is complicated only because the rights syntax is case sensitive and hardly intuitive.

Copy and paste the two lists shown into a notepad session to be called fix_rights.cmd. Here, I will do it for you:

ntrights +r SeNetworkLogonRight -u Administrator
ntrights +r SeInteractiveLogonRight -u Administrator
ntrights +r SeBatchLogonRight -u Administrator
ntrights +r SeServiceLogonRight -u Administrator
ntrights -r SeDenyNetworkLogonRight -u Administrator
ntrights -r SeDenyInteractiveLogonRight -u Administrator
ntrights -r SeDenyBatchLogonRight -u Administrator
ntrights -r SeDenyServiceLogonRight -u Administrator
ntrights +r SeCreateTokenPrivilege -u Administrator
ntrights +r SeAssignPrimaryTokenPrivilege -u Administrator
ntrights +r SeLockMemoryPrivilege -u Administrator
ntrights +r SeIncreaseQuotaPrivilege -u Administrator
ntrights +r SeUnsolicitedInputPrivilege -u Administrator
ntrights +r SeMachineAccountPrivilege -u Administrator
ntrights +r SeTcbPrivilege -u Administrator
ntrights +r SeSecurityPrivilege -u Administrator
ntrights +r SeTakeOwnershipPrivilege -u Administrator
ntrights +r SeLoadDriverPrivilege -u Administrator
ntrights +r SeSystemProfilePrivilege -u Administrator
ntrights +r SeSystemtimePrivilege -u Administrator
ntrights +r SeProfileSingleProcessPrivilege -u Administrator
ntrights +r SeIncreaseBasePriorityPrivilege -u Administrator
ntrights +r SeCreatePagefilePrivilege -u Administrator
ntrights +r SeCreatePermanentPrivilege -u Administrator
ntrights +r SeBackupPrivilege -u Administrator
ntrights +r SeRestorePrivilege -u Administrator
ntrights +r SeShutdownPrivilege -u Administrator
ntrights +r SeAuditPrivilege -u Administrator
ntrights +r SeSystemEnvironmentPrivilege -u Administrator
ntrights +r SeChangeNotifyPrivilege -u Administrator
ntrights +r SeRemoteShutdownPrivilege -u Administrator

Save the notepad session as fix_rights.cmd an double click to execute.

If you want the Win2k Resource Kit version of NTRIGHTS.EXE should work perfectly well, and can be downloaded directly. Place it in C:\Windows\System32 folder:

http://www.dynawell.com/reskit/microsoft/win2000/ntrights.zip

 

[bcastner]

The other issue to check if using the NTFS filestore is if the SYSTEM account no longer has priviliges on key areas of the hard drive. This most often happens when the Group Everyone is removed or priviliges restricted.

Follow the instructions here:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;259151

 

[bogboy1978]

Do I restart after running the cmd file?

 

[bcastner]

Yes.

 

[bogboy1978]

I tried going through the steps in the last link but cannot get past step 3

On the File menu, click Properties. Click the Security tab to view the current permissions

For some reason there is no Security tab to be seen, should it be up at the top along with the General, Tools, Hardware etc.. tabs?

 

[bcastner]

If you are using a FAT32 filestore instead of NTFS, then do not worry about the issue.

 

[bcastner]

Sorry, brain freeze. You only see the Security tab under Home in Safe Mode.

But for future reference see my "Cool Tip #2": thread779-685055

 

[linney]

One right you still have is the right to repair Windows which from your description seems pretty mucked up and in a state of complete mayhem.

You could try repairing windows by running it over itself. You will lose all your windows updates (no problem if you substitute them with SP2) but your files and programs will be untouched.

How to Perform an In-Place Upgrade (Reinstallation) of Windows XP (Q315341)

http://support.microsoft.com/support/kb/articles/q315/3/41.asp

Even if you are the only user, you should for security reasons have and use a limited user for the day to day working of your machine, and definitely for any Internet communication. It is a lot harder to cause damage from a limited user's profile than it is from an Administrators.