Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Policy Setting Removed

Posted on 2006-11-21
16
Medium Priority
?
383 Views
Last Modified: 2010-05-18
Someone deleted policies from Default Domain Policy and now Server is not accessible remotely.

Access this computer from network  - Noone added
Log on Locally  - Noone added

Please let us know a command that can be run remotely to access the server remotely.

We have tried everything to access this server from network but to no avail

Help is highly appreciated

Thanks!
0
Comment
Question by:Nirmal Sharma
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 6
  • 4
  • 4
  • +1
16 Comments
 
LVL 9

Assisted Solution

by:gopal_krishna
gopal_krishna earned 200 total points
ID: 17985681
If this is the case only administrator can login to the machine. do you have an admin account. then you would be able to access it.

cheers
Gopal K
0
 
LVL 33

Assisted Solution

by:Busbar
Busbar earned 600 total points
ID: 17985738
i think that booting from the directoiry service restore mode
then recover the policy as in this page
http://support.microsoft.com/kb/267553
0
 
LVL 33

Expert Comment

by:Busbar
ID: 17985746
adding:
after resotring them you might find the the default domain policy and default DC policy is modified and you might want to restore them
follow this article
http://support.microsoft.com/kb/555647
then follow this
http://support.microsoft.com/kb/833783
good luck
0
Back Up Your Microsoft Windows Server®

Back up all your Microsoft Windows Server – on-premises, in remote locations, in private and hybrid clouds. Your entire Windows Server will be backed up in one easy step with patented, block-level disk imaging. We achieve RTOs (recovery time objectives) as low as 15 seconds.

 
LVL 51

Expert Comment

by:Netman66
ID: 17987563
Log on localy using the Administrator (real) account.

Run DCGPOFIX /domain from a CMD prompt.

0
 
LVL 35

Author Comment

by:Nirmal Sharma
ID: 17991832
nah...

Is there any way to access server remotely.

Server is in another location.

ADMIN$ share is alive and we can't map because the base of IPC$ and ADMIN$ share is *above policy setting* - *Access this computer from network* retreived by LSASS.exe process on local computer. I have heard of a SQL script that takes control of server remotely. Is it true?

Thanks for your advise!
0
 
LVL 51

Expert Comment

by:Netman66
ID: 17992281
Get yourself a copy of Dameware Utilities.  You can push out the server-side service then connect using the Dameware Remote Control client.  You'll be on the console then.

0
 
LVL 33

Expert Comment

by:Busbar
ID: 17992884
you can use also psexec
0
 
LVL 35

Author Comment

by:Nirmal Sharma
ID: 17993144
Have tried it before posting over here...

Dameware utilities use ADMIN$ share to store service DLL on remote computer - thus require admin rights to perform this operation.

PSEXEC also does the same.
0
 
LVL 33

Expert Comment

by:Busbar
ID: 17993190
then you will not be able to do much, get a car and go to the remote location
0
 
LVL 35

Author Comment

by:Nirmal Sharma
ID: 17993390
NM,

What do you say?
0
 
LVL 51

Expert Comment

by:Netman66
ID: 17993467
Yes, you require Admin rights to install Dameware Remote service - I'm not certain where it connects to - it may be the IPC$ share which shouldn't be blocked regardless of what policy has been set as long as you use the local Admin account.

Give it a shot if you haven't already.

If it doesn't work, can you attach to an iLO?  You can hook the console if you have a remote access card in this thing.

0
 
LVL 35

Author Comment

by:Nirmal Sharma
ID: 18000901
Sorry to be unclear...

Already tried that...and also don't have an ILO attached.

I already have admin rights. The only problem is these two policy settings:

*Access this computer from network*
*Log on Locally*

These policy settings are controlled by LSASS.exe (Local Security Authority) and SRM. These policy settings on DC are in effect and flags for policies are already set in AD Security. LSASS.exe sits over top of any other network process.

So when anyone tries to access this computer from network the security policy settings are processed by LSASS.exe - just to check whether the requested operation can be performed or not.

I tried using the following following commands:

psexec.exe -u COMPUTER_NAME\user_name -p Password \\computer_name ntrights.exe ------------- to make necessary changes

psexec.exe -u DOMAIN_NAME\user_name -p Password \\computer_name ntrights.exe ------------- to make necessary changes
0
 
LVL 35

Author Comment

by:Nirmal Sharma
ID: 18000919
STATUS_LOGON_TYPE_NOT_GRANTED message returned by Network Monitor.
0
 
LVL 51

Accepted Solution

by:
Netman66 earned 1200 total points
ID: 18004285
Since the policy is a file itself, then you should be able to boot to the Recovery Console and change permissions on the folder where this resides - it would be in Sysvol\Sysvol\Policies.

If you can remove Read permissions for Authenticated Users - or maybe even Deny it, then you should be able to boot (with errors) into the OS long enough to clean it up.

Let me know.
0
 
LVL 35

Author Comment

by:Nirmal Sharma
ID: 18409711
I had to visit on-site to resolve this problem.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Organizations create, modify, and maintain huge amounts of data to help their businesses earn money and generally function.  Typically every network user within an organization has a bit of disk space to store in process items and personal files.   …
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
In this video, Percona Solution Engineer Dimitri Vanoverbeke discusses why you want to use at least three nodes in a database cluster. To discuss how Percona Consulting can help with your design and architecture needs for your database and infras…
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…

664 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question