Stupid admin tricks: applied restrictive user policy to administrator 2

[gregmuir2]

I can truthfully say I wasn't the one who did it, it was the other guy. We've been kicking around some more restrictive user policies for our terminal server users. The last time we both looked at it, we were happy with how things were locked down.

The other tech was in yesterday working at the rack and that server restarted itself without user intervention. When he logged into it to see what's up, he was stuck with the restrictive user policy, even as the admin!

I know that Microsoft released some autoupdates but this server 1) isn't set to autoinstall them and 2) no updates installed message popped up when he powered it on.

What's the trick for getting in and removing those restrictive policies? I'm guessing it would involve booting into safe mode, something we can't do in the middle of the day since the machine is in use. Any other tricks for regaining control would be appreciated.

Thanks!

 

[Roadki11]

Have you tried putting an explicit deny apply policy for the administrator account on the GP that locks down the TS?

RoadKi11

 

[monsterjta]

Are you receiving this restricted policy via Group Polocy or Local Policy?

I hope you find this post helpful,

Jonathan Almquist
Minneapolis, MN

 

[gregmuir2]

I haven't had a chance to look into this yet, typing up this question was as far as I'd gotten when I was pulled away. Roadkill, that sounds like another good place to start.

Monsterjta, I'm going to have to check to see how the original policy was setup. We put it together over a month ago and had no problems until just now so I forget the particulars of what we did. I'm sure it'll come back to me as I tear into it again.

Thanks for the feedback so far!