Workgroup

[iolair]

Don't hate me for not using Active Directory. I have a W2K8 server, Standard Edition, running a small network using a workgroup instead of a domain. When a workstation logs in, somewhere, somehow, a Group Policy is being applied that disables the users ability to change network settings, printer settings, and the power settings in control panel. This policy even prevents the administrator account from doing these things. Can anyone tell me where this is happening? Is it the local policy on the workstation (which I doubt), the local policy on the server, or is it something NETbios does by default when using a workgroup? Thanks.

Iolair MacWalter
Network Engineer

 

[kmcferrin]

It isn't a policy coming from the server or something NetBIOS or Workgroup related, so I'd look in the local machine policy. Run GPEDIT.MSC and you'll have to drill down through the potential settings to see which ones have been set.

If this machine was previously a domain member then you may have residual policies applying the to machine.

Also, verify that your administrator account actually has administrator privileges. Sometimes people rename the default local admin account something else and then create a new account called Administrator, thinking that it improves security. It actually doesn't, but it will cause more confusion.

________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCSE:Security 2003
MCITP:Server Administrator
MCITP:Enterprise Administrator
MCITP:Virtualization Administrator 2008 R2
Certified Quest vWorkspace Administrator

 

[iolair]

Thanks. Yes, the Administrator is the original administrator, so that's not the problem. There is a domain controller in the network, and even though these are workgroup computers, I'm now wondering if the default domain policy is having some kind of effect on them.

Thanks again.

Iolair MacWalter
Network Engineer

 

[kmcferrin]

Group policy is applied to a PC when it authenticates to the domain. The default domain policy can only be applied to them if they are domain members. If they are not domain members then the domain controller and domain administrator account dpes not have the security rights to be able to set policy on them.

If the machines were previously domain members then the policy may still be applying. If the machines were build with a custom image then the policy may have been set in the image. It is very likely something that is configured in the local policy.

________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCSE:Security 2003
MCITP:Server Administrator
MCITP:Enterprise Administrator
MCITP:Virtualization Administrator 2008 R2
Certified Quest vWorkspace Administrator

 

[iolair]

Is there a way to find out what policies are applied and if the default "server local policy" is being applied? I know I can run gpresult on a server, can it be run on a workstation?

Iolair MacWalter
Network Engineer

 

[baddos]

Yes, run gpresult on the workstation under the login that is affected.

 

[iolair]

Okay, I found out what it is. The "local security policy" on the server is being applied to the workstations. Now, I just have to go in and change that to allow the proper actions and rights. Thanks to all who helped.

Iolair MacWalter
Network Engineer