Re: Domain Administrator have lost all rights

From: Enkidu (enkidu_at_xyzcliffpxyz.com)
Date: 11/06/04 

Date: Sun, 07 Nov 2004 11:30:10 +1300

I'm pretty sure you can't remove the default domain controller's GPO.
See if you can access that and replace the group as suggested.

Try this KB article.

http://support.microsoft.com/default.aspx?scid=kb;en-us;226243

Cheers,

Cliff

On Sat, 6 Nov 2004 07:50:01 -0800, Fabrussio
<Fabrussio@discussions.microsoft.com> wrote:

>Thanks but I have deleted all GPO's and restricted groups and restarted the
>server but the Domain Admin access is still restricted.
>eg. I can't access any remote workstation c$ drive, I can't look at files
>that have administrator Full control permissions, I can't access any
>http://localhost web sites from the server.
>
>How can I get back control???
>
>
>"ptwilliams" wrote:
>
>> Restricted groups replaces group membership - it doesn't merge (well, it
>> can, but I can't remember the SP versions, and KBs). That's why it's called
>> restricted groups - you restrict what members are in what groups. Just open
>> up the GPO that you defined this in and add the domain admins group and any
>> other missing groups at the GPO level.
>>
>> --
>>
>> Paul Williams
>>
>> http://www.msresource.net
>> http://forums.msresource.net
>>
>>
>> "Fabrussio" <Fabrussio@discussions.microsoft.com> wrote in message
>> news:D133FFF0-2548-4EED-9C25-F5D53B93B488@microsoft.com...
>> i have a single DC w2k sp4.
>> I set up a restricted group in the AD to give workstation users - local
>> admin access.
>> I must have made a mistkae cos As soon as I set it up it stopped all my
>> domain admin access and IUSR access from the server. I have completely
>> removed all traces of the groups and related policy but the admin access
>> never returns.
>>
>> Tried restarting server.
>>
>> what to do????? please help!!
>>
>>
>>

Relevant Pages

  • Re: Domain Administrator have lost all rights
    ... > I'm pretty sure you can't remove the default domain controller's GPO. ... >>Thanks but I have deleted all GPO's and restricted groups and restarted the ... >>server but the Domain Admin access is still restricted. ... >>that have administrator Full control permissions, ...
    (microsoft.public.win2000.active_directory)
  • Automatic Updates options are greyed out, SBS 2003 and WSUS
    ... The SBS server is the DC ... GPO: Default Domain Policy ... Computer Setting: 50 ... GPO: Default Domain Controllers Policy ...
    (microsoft.public.windows.server.sbs)
  • Re: SCW question.
    ... Created a new Server and installed IIS. ... and saw that the default rights for IUSR and IWAM users are there. ... Server to the domain without and GPO's applied...Local Security policy ... rights (which coincides with my Member server GPO settings). ...
    (microsoft.public.windows.server.security)
  • RE: IE Security Group Policy
    ... username and password to access the Companyweb and the GPO did not apply on ... In the Security filtering of the GPO, please select the user account or ... Step 2: Check the IIS settings on the SBS Server: ...
    (microsoft.public.windows.server.sbs)
  • Re: Activated 2003SBS asking to be activated again?
    ... > IP of the server. ... > admin access, ... >> Kevin Weilbacher ... >>> obvious traces of what he did, and he couldn't divulge the details. ...
    (microsoft.public.windows.server.sbs)