Re: administrator locked out of SBS 2003

Cameraella wrote:
Created the new user and added to domain admins but didn't work.
The administrator is a member of the following groups:-
administrators
domain admins
domain users
enterprise admins
group policy creator owners
mobile users
schema admins

Other than lacking exchange administrator this is pretty much normal.

So, clarify for me, exactly what policy setting did you change on which
Group Policy Object and then disable?




Thanks again KJ

"kj [SBS MVP]" wrote:

Two things to try. One create a new user, then add to the domain
admins group. Try to logon to the console using this account.

Second, see which groups the administrator is a member of and post
back here.


Cameraella wrote:
No I made sure of that when I did my checks... compared it to
another SBS box I administrate, all exactly the same after the
deletion of the software restriction policy.
I was going to have a search of the GPO's over the weekend and hope
I find something.
Even the VMware KB's as I've all ready discovered the server V2.0
will not run with RRAS running, though its not documented.

Much appreciated.
Cameraella

"kj [SBS MVP]" wrote:

Cameraella wrote:
Hi Dave,
There was no disable, so I deleted the policy. Performed the
gpupdate /force and tried unsuccessfully to logon at the console.
Same error "The local policy of this system does not permit you to
log on interactively"
I also checked the user access rights whilst there and permit
logon locally is allowed for administrators, and deny logon
locally does not include the administrators.

Thanks again.


Check if any deny inlcudes any group that the user is a member of.
Deny overrides allow, even for administrators.


"Dave Nickason [SBS MVP]" wrote:

If you edited a GPO that's the cause of this, safe mode won't
help. What happens if you just log into the SBS remotely and
disable the new policy? Then open a cmd prompt and do gpupdate
/force - can you then log in locally to the server?


"Cameraella" <Cameraella@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message
news:D9D77FE6-0A8C-43ED-B1FE-0ED7C4B4003B@xxxxxxxxxxxxxxxx
HiJoe,
I hadn't tried remote access prior to post, but it does work
thanks. I had safe mode in mind as a last resort but the box is
60Klm's away.

Cheers

"Joe Smith" wrote:

have you tried logging in remotely? what about safemode?
do you have any other admin accounts set up?
"Cameraella" <Cameraella@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message
news:3D876D3C-B79F-4F98-808D-7125486704F6@xxxxxxxxxxxxxxxx
I think I have managed to lock the administrator out of
logging onto our SBS
03 server.
Whilst installing VMware server 2, the installation kept
failing reporting
"System Administrator has set policies to prevent this
installation." ....I
was logged on as administrator. To resolve this problem I
followed a suggestion to access the local security policy and
amend. As it was an SBS
03
box, I had to create a new blank policy in the Domain
controller security
policy, and the change the properties to enforce for all users
except administrators. This then allowed the VMware server
installation to complete.
I have restarted the server numerous times after this
installation 2 days
ago. For some reason today when I try to log on to the server
as administrator at the console I now get "The local policy
of this system does
not permit you to log on interactively."

Any suggestions would be greatly appreciated.

PS. I do have a system state backup from before the VMware
server upgrade
and any issues were experienced.


Thanks in advance.
Cameron

--
/kj

--
/kj

--
/kj


.

Relevant Pages

  • Re: administrator locked out of SBS 2003
    ... Try to logon to the console using this account. ... see which groups the administrator is a member of and post back ... Even the VMware KB's as I've all ready discovered the server V2.0 ... so I deleted the policy. ...
    (microsoft.public.windows.server.sbs)
  • Re: I shot my foot off almost and the Admin cant log into the server locally
    ... server. ... Keep a backup administrator id around. ... > By default the Administrator should be a member of these groups: ... > Administrators, Domain Admins, Domain Users, Enterprise Admins, Group ...
    (microsoft.public.windows.server.sbs)
  • Re: Must all users be administrators?
    ... The familiar look of the AD objects tree you see in Group Policy Editor is ... This seems modestly confusing to an SBS Administrator because there's very ... those rights happen to be nearly unlimited. ... sit a workstation logged on as the Local Administrator, by default, there ...
    (microsoft.public.windows.server.sbs)
  • Re: GP loopback processing on Windows 2003 terminal service, strange problem!
    ... You should not have to go through all that to get the policy to work ... Check that your other W2003 Server points ONLY to the domain controller ... > any other GP's then logging on to the TS server. ... > is not local administrator on this TS server? ...
    (microsoft.public.windows.group_policy)
  • Re: windows 20000 problem
    ... So you are saying the problem is on just this one particular server that is ... in an OU with other servers that do not lock down the domain admin account. ... The part about logging in as local account that bypasses this policy ... > and the administrator is in an OU where the policy doesnt apply. ...
    (microsoft.public.win2000.security)