Disaster Recovery as a Service is one go-to solution that revolutionizes DR planning. Implementing DRaaS could be an efficient process, easily accessible to non-DR experts. Learn about monitoring, testing, executing failovers and failbacks to ensure a "healthy" DR environment.
Solved
Disabling Group Policy Management (locked out!)
Posted on 2013-01-01
Hi
OK, I have done something terribly stupid.
On the domain controler, I have was playing with a new group policy for our new terminal server. As you can understand, I limited as much as possible (cmd, powershell, regedit, etc). Stupid me, I also restricted the administrator user.
Now, when logging in to the server or any other for that matter, it blocks all. I can not remove this policy. What can I do to temporarily disable GPO, and unset it (at least for admin users)?
OK, I have done something terribly stupid.
On the domain controler, I have was playing with a new group policy for our new terminal server. As you can understand, I limited as much as possible (cmd, powershell, regedit, etc). Stupid me, I also restricted the administrator user.
Now, when logging in to the server or any other for that matter, it blocks all. I can not remove this policy. What can I do to temporarily disable GPO, and unset it (at least for admin users)?
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
6
4
3- +2
16 Comments
Active today
Method #1: Very simple, on the GPO, go to the last tab, bottom right, click that button, add your admin account/group and then set the Deny right to the policy object. OK out, exit the GPO and reboot your server.
Method #2: move the server object in AD to an OU where the GPO does not apply, reboot the server.
ALWAYS do method 1 when creating new GPOs. Another piece of advice, never create AND link a GPO when you create it. Always create a new GPO in the Group Policy Object container in the GP Mgmt Console.
Method #2: move the server object in AD to an OU where the GPO does not apply, reboot the server.
ALWAYS do method 1 when creating new GPOs. Another piece of advice, never create AND link a GPO when you create it. Always create a new GPO in the Group Policy Object container in the GP Mgmt Console.
M1: Will probably not work. I disabled cmd/powershell, and all access to control panel.
M2: How do I do this?
M2: How do I do this?
Active today
Was the GPO linked to an OU where your terminal servers reside? Or linked at the domain level?
Ouch indeed!
Well, I am installing it FOR a production. But I am so far done... Would cost me lot of work to start over :(
Would like to add, I can boot from Win2012 DVD, go to recovery cmd prompt, and run regedit. Anything I can do there to temporarily disable GPO?
Well, I am installing it FOR a production. But I am so far done... Would cost me lot of work to start over :(
Would like to add, I can boot from Win2012 DVD, go to recovery cmd prompt, and run regedit. Anything I can do there to temporarily disable GPO?
Active today
can you run services.msc and disable the Group Policy service?
or maybe:
sc config gpsvc start= disabled (yes that is a space after the =)
If that doesn't work,
Computer\HKLM\SYSTEM\CCS\s
change from 2 to 4
or maybe:
sc config gpsvc start= disabled (yes that is a space after the =)
If that doesn't work,
Computer\HKLM\SYSTEM\CCS\s
change from 2 to 4
Active 1 day ago
Why can't you just delete the GPO link and reboot the server?
this should remove the GP settings.
this should remove the GP settings.
Active 2 days ago
How exactly did you apply the restrictions?
Any chance you could build a new VM or image a PC real quick that's not on your domain, install RSAT, join the machine to the domain but *don't* reboot yet... use run-as to load the GPMC or PowerShell and disable the bad policy.
The restrictive GPO won't actually apply to the machine you'd be using until you reboot... you'll have to definitely launch whatever tools you need using domain admin credentials which should be no problem once the join operation finishes... you'll be prompted for credentials enough to drive you crazy but it is a window that you can possibly exploit..?
Any chance you could build a new VM or image a PC real quick that's not on your domain, install RSAT, join the machine to the domain but *don't* reboot yet... use run-as to load the GPMC or PowerShell and disable the bad policy.
The restrictive GPO won't actually apply to the machine you'd be using until you reboot... you'll have to definitely launch whatever tools you need using domain admin credentials which should be no problem once the join operation finishes... you'll be prompted for credentials enough to drive you crazy but it is a window that you can possibly exploit..?
Active 2 days ago
Another idea... why not just edit the ADM files for that policy in notepad to remove the restriction on the admin user so you can clean this up... I wouldn't just delete the policy but you should be able to browse to \\yourdomain\sysvol\yourdo
??
??
Active 2 days ago
Access the sysvol folder with administrator ID
Take owner ship of the folder and put deny access to GUID of folders under \\domain.local\sysvol\poli
In this way you would deny access to GPO and so policies will not be applied to Administrator user ID then you can login to DC and fine tune settings via GPMC
Take owner ship of the folder and put deny access to GUID of folders under \\domain.local\sysvol\poli
In this way you would deny access to GPO and so policies will not be applied to Administrator user ID then you can login to DC and fine tune settings via GPMC
Active 2 days ago
@sarang... I'm not sure that would work in this case... the policy has already propogated out to his domain so unless there is some type of update that revokes the policy or modifies the policy settings it won't just stop applying...
Active 2 days ago
Ok..so create another admin account by installing admin pack on one of the member machine and do same with that ...lets see if that works
Featured Post
Every day, more and more legacy backup customers switch to Veeam. Technologies designed for the client-server era cannot restore any IT service running in the hybrid cloud within seconds. Learn top Veeam advantages over legacy backup and get Veeam for the price of your renewal
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
Had a business requirement to store the mobile number in an environmental variable. This is just a quick article on how this was done.
Microsoft Office 365 is a subscriptions based service which includes services like Exchange Online and Skype for business Online. These services integrate with Microsoft's online version of Active Directory called Azure Active Directory.
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.
Suggested Courses
Course of the Month8 days, 17 hours left to enroll
604 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.