Re: Interactive Logon problem on Server

From: Frank McCallister (anonymous)
Date: 07/26/04


Date: Mon, 26 Jul 2004 08:08:10 -0500

Hi Clive

That is strange! If you checked Gp Policy and you are correct that you have
the default groups the only thing I can think of is maybe somehow one of
those groups got another group added as a member although you aren't
supposed to be able to do that. Open each of those groups and see if they
have member groups that aren't supposed to be there. Otherwise you may have
something corrupt in your AD or registry. Maybe someone else has seen this.

Frank
"Clive Start" <clive@NOSPAM.THANKS.pc4me.co.nz> wrote in message
news:u$%23Fq0tcEHA.212@TK2MSFTNGP12.phx.gbl...
> Thanks for the reply Susan. I didn't find that one when searching. It
> didn't solve my problem though.
>
> The Administrator user account is a member of:
> Administrators
> Domain Admins
> Domain Users
> Enterprise Admins
> Schema Admins
> Group Policy Creator OWners
> Mobile Users
>
> They were all set up automatically AFAIK.
>
> Any other ideas?
>
> Thanks,
> Clive.
>
> "Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@pacbell.net>
> wrote in message news:O280cutcEHA.3616@TK2MSFTNGP10.phx.gbl...
>>
>> From: Frank McCallister (anonymous)
>> Subject: Re: Admin account cannot log on locally
>>
>>
>> View this article only
>> Newsgroups: microsoft.public.windows.server.sbs
>> Date: 2004-07-03 15:30:51 PST
>>
>>
>> Hi Heath
>>
>> Logon Remotely and open the User account for Administrator and be sure
>> the
>> Member of does not include Power Users or Remote Operators or any othe
>> unnecessary ones. These two will prevent you from logging on locally.
>>
>> Frank McCallister
>> COMPUMAC
>>
>>
>> Clive Start wrote:
>>
>>> Hi all,
>>>
>>> This is a wierd one. All of a sudden we seem to be running into a
>>> permissions problem on the server itself. We cannot logon interactively
>>> using any user id at all - not even administrator! I can access the
>>> server via RWW but cannot find the policy that is restricting logon.
>>>
>>> I have checked the Default Domain Controllers Policy (Allow Logon
>>> Locally) and (Deny Logon Locally). These values do not appear to
>>> conflict and should AFAIK allow interactive logon at the server to
>>> Administrator and a few other logons, none of which work.
>>>
>>> Do I need to look at resetting my Group Policy to original setup
>>> options? Are they the "setup security" .inf file? Will I need to
>>> reprocess anything post reset (CIECW etc)?
>>>
>>> Should this question be in another group?
>>>
>>> Thanks,
>>> Clive
>>
>> --
>> http://www.sbslinks.com/really.htm
>
>



Relevant Pages

  • Re: Cannot logon locally at the console
    ... setting is applied to the Remote Operators group in the Default Domain ... Controllers Group Policy object. ... Domain Power Users group because the Domain Power Users group is a member ... Administrator account from the Remote Operators group and the Domain Power ...
    (microsoft.public.windows.server.sbs)
  • Re: Login as local admin
    ... So if i basically ensure that my domain administrator account is a member of ... the schema admins, and enterprise admins, and login using these credentials, ... The article does not reference "local" administrator (as far as I ... If you choose to use an account other than the built-in administrator ...
    (microsoft.public.windows.server.sbs)
  • Re: administrator locked out of SBS 2003
    ... enterprise admins ... group policy creator owners ... Other than lacking exchange administrator this is pretty much normal. ... Even the VMware KB's as I've all ready discovered the server V2.0 ...
    (microsoft.public.windows.server.sbs)
  • Re: I shot my foot off almost and the Admin cant log into the server locally
    ... server. ... Keep a backup administrator id around. ... > By default the Administrator should be a member of these groups: ... > Administrators, Domain Admins, Domain Users, Enterprise Admins, Group ...
    (microsoft.public.windows.server.sbs)
  • Re: Unable to Edit GPO
    ... As a member of this group you should be able to create a new policy object ... > Domain Admins or Enterprise Admins. ...
    (microsoft.public.windows.group_policy)