2008 Domain Controller - parameter is incorrect (c:\windows\system32)

Posted on 2010-08-19
Last Modified: 2012-05-10
Interesting that I have not encountered but everytime I run any manamgement tool from C:\Windows\System32 (i.e. dsa.msc, dns etc) I get the error "Parameter is incorrect".

I am only able to run tools under Domain "Administrator" other account works even if it is in the Domain\Administrators group. I checked permissions on C:\ (root) and \Windows\System32 and permission are inherited from Root drive with Domain\Administrators in the ACL but it does not work. I can only use the tools as the Administrator

I can only assume this is some extended 2008 security feature. I looked at UAC and made changes but no results.

Please give some insight.

Question by:MGA2
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2

Expert Comment

ID: 33481316
Hello !

Try to redo the association of msc files withh mmc.exe.

Maybe the association in HKCR is wrong but the Admin account has something different under HKCU\Software\Classes...


Author Comment

ID: 33488986
did not work..any other thoughts? I was not sure what you referring with HKCU

Author Comment

ID: 33489375
what is interesting is the the Domain "Administrator" which is part of the Domain\Administrators group. I am using a user account that is part of that same group and Domain\Administrators has Full access at Root C:\ drive and down. For some reason only the "Administrator" can run the tools.
Never seen this prior to 2008. Not sure what enhanced Security of other reason this is occuring but it is odd.
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!


Expert Comment

ID: 33489474
Hello !

Not sure it's an enhance security measure as much as a configuration error.

Clone the Administrator account (name it Test_Admin or whatever) and try with that user. In all logic, it should work. If it does, clone a non-working user (name it Test_Not_Admin) and try. It should not work. Now copy the Administrator profile over that new user's profile (you know how ?). Try again. If, as I believe, there's an error in the registry, it will work. If you are correct and it's some security measure, it will not.

I have another idea but no time to write it down now.


Author Comment

ID: 33513228

Cloning does not work. I also copied the Administrator profile and still same results
This is a newly installed system so very little changes since OS build and DC services installed.

Note: server running on top of VMWare ESXi Hypervisor


Accepted Solution

MGA2 earned 0 total points
ID: 33513716

I have resolved this myself. UAC needed to be "disabled" (do you know how?) Of course UAC is a new "security" feature in Vista/2008 OS. It is enabled by default

Go to Local Policies --> User Account Control: Run all administrators in Admin Approval Mode (Disable)

Featured Post

Get 15 Days FREE Full-Featured Trial

Benefit from a mission critical IT monitoring with Monitis Premium or get it FREE for your entry level monitoring needs.
-Over 200,000 users
-More than 300,000 websites monitored
-Used in 197 countries
-Recommended by 98% of users

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
A procedure for exporting installed hotfix details of remote computers using powershell
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…
Suggested Courses

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question