Solved

registry editing has been disabled by your administrator

Posted on 2010-09-01
9
1,404 Views
Last Modified: 2012-05-10
Hi,

I have a domain user (%USER%) that is set as local administration on a specific server(W2K3 R2 std) in my domain.
This user is in a separate OU in the AD. This OU contains a policy that grand the user RDP rights. This works fine.

Now I want the user to be able to edit the registry. Run>regedit
The following error accurse:
"registry editing has been disabled by your administrator"

I have made a new policy for this OU
set:
“Prevent access to registry editing tools” to disable

ran gpupdate & even rebooted the system.

This does not work!

Can anyone help me out?
0
Comment
Question by:sayadi
9 Comments
 
LVL 6

Expert Comment

by:Nuttycomputer
ID: 33576565
You stated the User is in the OU. Is the server also in this OU? If the Server is in an OU that denies editing registry via the Computer Configuration of Group Policy then in the case of conflicting policies Computer Configuration takes precedence over User Policy.
0
 
LVL 12

Expert Comment

by:patrikt
ID: 33576569
Check higher GP objects, because if registry editing is disabled there it gets preference.
In case you have it disabled on root domain GP object you should filter this GP for admins to be able to edit registry.
0
 
LVL 42

Expert Comment

by:sedgwick
ID: 33576582
0
Use Case: Protecting a Hybrid Cloud Infrastructure

Microsoft Azure is rapidly becoming the norm in dynamic IT environments. This document describes the challenges that organizations face when protecting data in a hybrid cloud IT environment and presents a use case to demonstrate how Acronis Backup protects all data.

 
LVL 4

Assisted Solution

by:mikesuss
mikesuss earned 150 total points
ID: 33576619
Is there another more restrictive policy that is applying?  You might want to create a temporary admin user to allow the change, then remove the user.  This would more than likely be faster than trying to trouble shoot the registry issue for a one off.
0
 
LVL 2

Author Comment

by:sayadi
ID: 33576647
Under %myDomain.local% there is a OU for the server & a OU for the users on both OU's now I have set this policy and it still does not work!
0
 
LVL 2

Author Comment

by:sayadi
ID: 33576706
The only other policy that is implemented is to prevent the user from a shutdown. they can only logout.
0
 
LVL 6

Accepted Solution

by:
Nuttycomputer earned 350 total points
ID: 33576803
Sayadi,

Run the RSoP in Logging mode. Select the Server and User in question and that will allow you to see what settings are applying and from what GPOs. Might be able to narrow it down a little easier. See this: http://technet.microsoft.com/en-us/library/cc758010%28WS.10%29.aspx

Also if you set the policy just barely on the servers you need to reboot for it to apply on the servers as computer policies are applied at startup.
0
 
LVL 1

Expert Comment

by:amieldar
ID: 33577530
try to set a new  ou and disable enharit
0
 
LVL 2

Author Comment

by:sayadi
ID: 33584734
It was a confilicting Policy
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
This script can help you clean up your user profile database by comparing profiles to Active Directory users in a particular OU, and removing the profiles that don't match.
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question