Local Policy

[RonCSS]

A user has set a policy on their machine so the domain admin has no access to any of the policy settings or any other settings. I need to create a group policy that will not allow anyone to change the local admin password nor lock the domain admin out of anything. Any suggestions?

Thanks.

 

[MattWray]

Create a Domain Policy to Deny Logon Locally. Computer Configuration-> Windows Settings-> Security Settings-> Local Policies-> User Rights. Not sure if that will work, but I think it would...

Thanks,

Matt Wray

http://www.total-tec.com

http://www.sss-steel.com

 

[hewissa]

I would disagree with Matt on this one, Deny locally will deny users the right to access their computers.

Was this user a domain admin or local admin?

Sounds like they were granted local or domain admin rights. I would prevent them access to doing this by making them a domain user. If you need to grant elevated privlages, make the users Power Users. Domain users and local Power Users don't have access to the GPO mmc nor can they access the local security policy.

Further more, rename the Admin account through a GPO and enable the Restricted Groups policy to only allow those in the group can be admins. Furthermore, disable the mmc program to domain Users.

Hewissa

MCSE, CCNA, CIW

 

[RonCSS]

Yes, they were a domain admin. I don't know why, another admin had given them the rights. I can make them power users. If i do this, how do change the local policy back to the domain admin having full rights to the machine?

 

[hewissa]

To prevent this I would envoke the Restricted Groups Policy so that only you can "Grant" admin rights, and only those in the Restricted Group would be admins.

As for the local policy, you could replace the policy template. Either configure one from a different machine or replace it with an original template.

http://www.jsifaq.com/SUBK/tip5300/rh5347.htm

Hewissa

MCSE, CCNA, CIW

 

[MattWray]

Hewissa,
When you say that the Deny Logon Locally would prevent them from accessing their computers, do you mean the local machines? They would not be able to still logon to the Domain?

Thanks,

Matt Wray

http://www.total-tec.com

http://www.sss-steel.com

 

[hewissa]

Yes Matt, an attempt to log on with this policy enabled would result in the error "The local policy of this system does not permit you to logon interactively". If it is applied at the Domain level then it would affect all computers (unless an ou has blocked it).

rmagers, I found the steps to replace the local policy:

1. Connect to the problem computer with a Net use x: \\ProblemComputerName\C$ <Password> /u:Administrator

2. Navigate to the %SystemRoot%\Security\Database folder.

3. Rename Secedit.sdb to Secedit.old_sdb.

4. Copy an operational Secedit.sdb from a Windows 2000 platform of the same edition (Server to Server or Professional to Professional).

5. Shutdown and restart the problem computer.

Hewissa

MCSE, CCNA, CIW