group policy

[doc365]

Hello All,

I am trying to solve an issue that I think may be related to group policy. I am a desktop support analyst for a company and initially I was given "Domain Admin" privilges to install/configure software and hardware by the head network administrator. But here recently I have noticed that I can't install anything on my machine it says that the "requested operation requires elavation" or when I try to check the group polices editor(start, run gpedit.msc), it tells me that the Access is denied. Now I am running windows vista, but I still should be able to right click, shift and select "run as administrator" but still no go. I have Terminal Services into one of the servers to check my domain account and its not "locked out" and I am still part of the "domain admin" group, but I can't do rudimentary tasks. Is this some sort of cruel vista trick or is the Head Network Administrator restricting permissions because this company is trying to send a message to me. I will resign I can get another job but I need to know. Its frustrating because I even tried copying another network adminstrator's account with a dummy user account(no mailbox) attached ad login with that but still no success. When I asked the Head Network Administrator in person he said oh "I'll look into it" what kind of crap is that?

Anyways this could very well be a group policy restriction, but I would think that if it was then I would be able to do simple things!

Any help would be greatly appreciated!

Thanks

 

[pgaliardo]

Not real familiar with Vista yet, but if there is an XP machine there you can log onto and try, then you can rule out if it is a Vista issue.

My guess is that they tightened up the Group Policies on the domain. Doesn't matter if you are a domain admin, they can still apply policies to you.

 

[TAiNiUM]

If they have your user account in a OU with a policy forbidding what you are trying to do then the policy will override.

Here is a link to the vista GPO's

http://www.microsoft.com/downloads/...9b-3328-4350-ade1-c0d9289f09ef&displaylang=en

 

[PcLinuxGuru]

Sounds more like he delegated stuff to your account rather than put your account in the domain admin group. What does your network admin say when you told him of the issue?

 

[PcLinuxGuru]

Hehe never mind on the what he said as I see you posted it.

 

[lhuegele]

There are many more concrete ways to "send you a message". If that's what they were trying to do, they picked a poor way to do it imho.

We use local admin groups here and anyone with a domain admin account also has a regular user account that they use 99% of the time. They are only allowed to use their domain admin account when absolutly necessary. This is a security precaution.

Good luck either way.

 

[doc365]

basically what I think was done was domain admin privileges were removed from the local admins group but I created another local admin group that in the past and I forgot about that one. I was able login with that and now I can install but the trippy part of this is whenever I try to add a domain admins account to the local Administrators group, it tells me access is denied...

stay tuned in this IT soap opera!