Re: administrator locked out of SBS 2003

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

Cameraella wrote:
1. Administrative tools\Domain controller security settings > there
is no user settings there.
2. "applies to all users except administrators"
3. This is a known issue when installing VMware server 2.0, I was
guided by a link to the document on the VMware site.

So far, I've only been able to find this regarding your VMWare 2.0 install
and this seems to be the guidance about that;

http://support.microsoft.com/kb/925336

At this point, I'd only be guessing at what settings were applied.



"kj [SBS MVP]" wrote:

Did you do this for the user or the computer settings of the GPO?

What restrictions did you configur within the software restriciton
policy?

Did you do this by direction of a VMWare document or guidance from a
blog?

Deleting a policy does not necessarily undo the settings that were
applied.

Cameraella wrote:
The domain controller security policy > software restriction policy.
I created a new policy and then in the properties of the new policy
selected "applies to all users except administrators" That allowed
the installation of VMware server to complete.

I have since deleted this policy.

"kj [SBS MVP]" wrote:

Cameraella wrote:
Created the new user and added to domain admins but didn't work.
The administrator is a member of the following groups:-
administrators
domain admins
domain users
enterprise admins
group policy creator owners
mobile users
schema admins

Other than lacking exchange administrator this is pretty much
normal.

So, clarify for me, exactly what policy setting did you change on
which Group Policy Object and then disable?




Thanks again KJ

"kj [SBS MVP]" wrote:

Two things to try. One create a new user, then add to the domain
admins group. Try to logon to the console using this account.

Second, see which groups the administrator is a member of and
post back here.


Cameraella wrote:
No I made sure of that when I did my checks... compared it to
another SBS box I administrate, all exactly the same after the
deletion of the software restriction policy.
I was going to have a search of the GPO's over the weekend and
hope I find something.
Even the VMware KB's as I've all ready discovered the server
V2.0 will not run with RRAS running, though its not documented.

Much appreciated.
Cameraella

"kj [SBS MVP]" wrote:

Cameraella wrote:
Hi Dave,
There was no disable, so I deleted the policy. Performed the
gpupdate /force and tried unsuccessfully to logon at the
console. Same error "The local policy of this system does not
permit you to log on interactively"
I also checked the user access rights whilst there and permit
logon locally is allowed for administrators, and deny logon
locally does not include the administrators.

Thanks again.


Check if any deny inlcudes any group that the user is a member
of. Deny overrides allow, even for administrators.


"Dave Nickason [SBS MVP]" wrote:

If you edited a GPO that's the cause of this, safe mode won't
help. What happens if you just log into the SBS remotely and
disable the new policy? Then open a cmd prompt and do
gpupdate /force - can you then log in locally to the server?


"Cameraella" <Cameraella@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in
message
news:D9D77FE6-0A8C-43ED-B1FE-0ED7C4B4003B@xxxxxxxxxxxxxxxx
HiJoe,
I hadn't tried remote access prior to post, but it does work
thanks. I had safe mode in mind as a last resort but the box
is 60Klm's away.

Cheers

"Joe Smith" wrote:

have you tried logging in remotely? what about safemode?
do you have any other admin accounts set up?
"Cameraella" <Cameraella@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote
in message
news:3D876D3C-B79F-4F98-808D-7125486704F6@xxxxxxxxxxxxxxxx
I think I have managed to lock the administrator out of
logging onto our SBS
03 server.
Whilst installing VMware server 2, the installation kept
failing reporting
"System Administrator has set policies to prevent this
installation." ....I
was logged on as administrator. To resolve this problem I
followed a suggestion to access the local security policy
and amend. As it was an SBS
03
box, I had to create a new blank policy in the Domain
controller security
policy, and the change the properties to enforce for all
users except administrators. This then allowed the VMware
server installation to complete.
I have restarted the server numerous times after this
installation 2 days
ago. For some reason today when I try to log on to the
server as administrator at the console I now get "The
local policy of this system does
not permit you to log on interactively."

Any suggestions would be greatly appreciated.

PS. I do have a system state backup from before the VMware
server upgrade
and any issues were experienced.


Thanks in advance.
Cameron

--
/kj

--
/kj

--
/kj

--
/kj

--
/kj


.

Relevant Pages

  • Re: administrator locked out of SBS 2003
    ... Restriction Policies node and select New Software Restriction Policy ... Select "All users except local administrators" ... This is a known issue when installing VMware server 2.0, ... the installation kept ...
    (microsoft.public.windows.server.sbs)
  • Re: administrator locked out of SBS 2003
    ... This is a known issue when installing VMware server 2.0, ... Deleting a policy does not necessarily undo the settings that were applied. ... selected "applies to all users except administrators" That allowed ...
    (microsoft.public.windows.server.sbs)
  • Re: administrator locked out of SBS 2003
    ... The Domain Admins group was a member of the Remote Operators ... My suspicion is that the policy change 'tattooed' the ... Select "All users except local administrators" ... That allowed the installation of VMware server to complete. ...
    (microsoft.public.windows.server.sbs)
  • Re: Restrict to 1 program
    ... Can I create the policy, apply it to the ... You can link a GPO to a site, or a domain, or an OU, and it will be ... MCSE, CCEA, Microsoft MVP - Terminal Server ... it doesn't apply to Administrators: ...
    (microsoft.public.windows.terminal_services)
  • Re: administrator locked out of SBS 2003
    ... My suspicion is that the policy change 'tattooed' the ... Select "All users except local administrators" ... This is a known issue when installing VMware server 2.0, ... That allowed the installation of VMware server to complete. ...
    (microsoft.public.windows.server.sbs)