?
Solved

registry editing has been disabled by your administrator

Posted on 2010-09-01
9
Medium Priority
?
1,435 Views
Last Modified: 2012-05-10
Hi,

I have a domain user (%USER%) that is set as local administration on a specific server(W2K3 R2 std) in my domain.
This user is in a separate OU in the AD. This OU contains a policy that grand the user RDP rights. This works fine.

Now I want the user to be able to edit the registry. Run>regedit
The following error accurse:
"registry editing has been disabled by your administrator"

I have made a new policy for this OU
set:
“Prevent access to registry editing tools” to disable

ran gpupdate & even rebooted the system.

This does not work!

Can anyone help me out?
0
Comment
Question by:sayadi
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
9 Comments
 
LVL 6

Expert Comment

by:Nuttycomputer
ID: 33576565
You stated the User is in the OU. Is the server also in this OU? If the Server is in an OU that denies editing registry via the Computer Configuration of Group Policy then in the case of conflicting policies Computer Configuration takes precedence over User Policy.
0
 
LVL 12

Expert Comment

by:patrikt
ID: 33576569
Check higher GP objects, because if registry editing is disabled there it gets preference.
In case you have it disabled on root domain GP object you should filter this GP for admins to be able to edit registry.
0
 
LVL 42

Expert Comment

by:Meir Rivkin
ID: 33576582
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 
LVL 4

Assisted Solution

by:mikesuss
mikesuss earned 600 total points
ID: 33576619
Is there another more restrictive policy that is applying?  You might want to create a temporary admin user to allow the change, then remove the user.  This would more than likely be faster than trying to trouble shoot the registry issue for a one off.
0
 
LVL 2

Author Comment

by:sayadi
ID: 33576647
Under %myDomain.local% there is a OU for the server & a OU for the users on both OU's now I have set this policy and it still does not work!
0
 
LVL 2

Author Comment

by:sayadi
ID: 33576706
The only other policy that is implemented is to prevent the user from a shutdown. they can only logout.
0
 
LVL 6

Accepted Solution

by:
Nuttycomputer earned 1400 total points
ID: 33576803
Sayadi,

Run the RSoP in Logging mode. Select the Server and User in question and that will allow you to see what settings are applying and from what GPOs. Might be able to narrow it down a little easier. See this: http://technet.microsoft.com/en-us/library/cc758010%28WS.10%29.aspx

Also if you set the policy just barely on the servers you need to reboot for it to apply on the servers as computer policies are applied at startup.
0
 
LVL 1

Expert Comment

by:amieldar
ID: 33577530
try to set a new  ou and disable enharit
0
 
LVL 2

Author Comment

by:sayadi
ID: 33584734
It was a confilicting Policy
0

Featured Post

Get your Disaster Recovery as a Service basics

Disaster Recovery as a Service is one go-to solution that revolutionizes DR planning. Implementing DRaaS could be an efficient process, easily accessible to non-DR experts. Learn about monitoring, testing, executing failovers and failbacks to ensure a "healthy" DR environment.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Uncontrolled local administrators groups within any organization pose a huge security risk. Because these groups are locally managed it becomes difficult to audit and maintain them.
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
With the advent of Windows 10, Microsoft is pushing a Get Windows 10 icon into the notification area (system tray) of qualifying computers. There are many reasons for wanting to remove this icon. This two-part Experts Exchange video Micro Tutorial s…
Microsoft Active Directory, the widely used IT infrastructure, is known for its high risk of credential theft. The best way to test your Active Directory’s vulnerabilities to pass-the-ticket, pass-the-hash, privilege escalation, and malware attacks …

650 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question