Solved

2008 Domain Controller - parameter is incorrect (c:\windows\system32)

Posted on 2010-08-19
6
1,086 Views
Last Modified: 2012-05-10
Interesting that I have not encountered but everytime I run any manamgement tool from C:\Windows\System32 (i.e. dsa.msc, dns etc) I get the error "Parameter is incorrect".

I am only able to run tools under Domain "Administrator".....no other account works even if it is in the Domain\Administrators group. I checked permissions on C:\ (root) and \Windows\System32 and permission are inherited from Root drive with Domain\Administrators in the ACL but it does not work. I can only use the tools as the Administrator

I can only assume this is some extended 2008 security feature. I looked at UAC and made changes but no results.

Please give some insight.

Thanks
0
Comment
Question by:MGA2
  • 4
  • 2
6 Comments
 
LVL 8

Expert Comment

by:SylvainDrapeau
ID: 33481316
Hello !

Try to redo the association of msc files withh mmc.exe.

Maybe the association in HKCR is wrong but the Admin account has something different under HKCU\Software\Classes...

Syldra
0
 

Author Comment

by:MGA2
ID: 33488986
did not work..any other thoughts? I was not sure what you referring with HKCU
0
 

Author Comment

by:MGA2
ID: 33489375
what is interesting is the the Domain "Administrator" which is part of the Domain\Administrators group. I am using a user account that is part of that same group and Domain\Administrators has Full access at Root C:\ drive and down. For some reason only the "Administrator" can run the tools.
Never seen this prior to 2008. Not sure what enhanced Security of other reason this is occuring but it is odd.
0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 8

Expert Comment

by:SylvainDrapeau
ID: 33489474
Hello !

Not sure it's an enhance security measure as much as a configuration error.

Clone the Administrator account (name it Test_Admin or whatever) and try with that user. In all logic, it should work. If it does, clone a non-working user (name it Test_Not_Admin) and try. It should not work. Now copy the Administrator profile over that new user's profile (you know how ?). Try again. If, as I believe, there's an error in the registry, it will work. If you are correct and it's some security measure, it will not.

I have another idea but no time to write it down now.

Syldra
0
 

Author Comment

by:MGA2
ID: 33513228
@SylvainDrapeau,

Cloning does not work. I also copied the Administrator profile and still same results
This is a newly installed system so very little changes since OS build and DC services installed.

Note: server running on top of VMWare ESXi Hypervisor

0
 

Accepted Solution

by:
MGA2 earned 0 total points
ID: 33513716
@SylvainDrapeau,

I have resolved this myself. UAC needed to be "disabled" (do you know how?) Of course UAC is a new "security" feature in Vista/2008 OS. It is enabled by default

Go to Local Policies --> User Account Control: Run all administrators in Admin Approval Mode (Disable)
0

Featured Post

Do email signature updates give you a headache?

Do you feel like you are constantly making changes to email signatures? Are the images not formatting how you want them to? Want high-quality HTML signatures on all devices, including on mobiles and Macs? Then, let Exclaimer solve all your email signature problems today.

Join & Write a Comment

Normally after a failure of Domain Controller, when promoting new DC the DC is renamed, we will discuss the options in Dcpromo to re-create the DC with the same name. Scenario: You are a small IT shop with two Domain Controllers (Domain Contr…
New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
This tutorial will show how to push an installation of Backup Exec to an additional server in both 2012 and 2014 versions of the software. Click on the Backup Exec button in the upper left corner. From here, select Installation and Licensing, then I…
This tutorial will walk an individual through the steps necessary to enable the VMware\Hyper-V licensed feature of Backup Exec 2012. In addition, how to add a VMware server and configure a backup job. The first step is to acquire the necessary licen…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now