mmc

[patrysib]

I made a GPO that blocks mms.exe. because of this I can not run "users and computers","dns" and other useful to active directory. how can I do to erase or modify that gpo ?

 

[markdmac]

Delete the policy from the registry. GPOs are stored in 4 locations.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\Group Policy
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
\Group Policy
HKEY_CURRENT_USER\Software\Software\Policies\Microsoft

Delete the policy entries under those hives and you will be able to launch MMC. Then you will want to EXCLUDE ADMINISTRATOR from the GPOs so you don't have the problem again.

Whenever you make a GPO, it is best to block it from applying to the Admin ID. Right click the top most part of the GPO in the tree. Choose Properties. Click the Security tab. Scroll down in the list and you will see an option for Apply GPO. Add administrator and set to Deny to ensure the Admin can always access the tools.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.