Link to home
Start Free TrialLog in
Avatar of Nick67
Nick67Flag for Canada

asked on

Help! My default domain group policy has become corrupt and it is disallowing ALL .exe files from running

I have the cryptolocker blocking rules in place, blocking access from the temp directories, but somehow the policy has become corrupt and is now disallowing all exe files from running.
The SBS 2008 box and other workstations are slowly becoming unusable
I can't run mmc regedit, gpedit or anything else on the server as they are blocked.

I cannot run dcgpofix as it is an exe too, and block by this corrupt policy

How can I fix this before every machine quits working?
I can run regedit on a workstation and have attached to the remote registry of the server
Avatar of Radhakrishnan
Radhakrishnan
Flag of India image

Hi,

Can't even you open gpmc and revert back the changes? You could try to restore the sysvol from previous working backup.

If you are able to open command prompt then try this command

dcgpofix /target:Domain

PS - This will delete all the default domain policy settings. Usually this should perform as last resort.

Hope this helps.
Avatar of Nick67

ASKER

MMC is an exe, and won't run
dcgpofix is an exe, and won't run.
No exe on the server will run

At the moment I can still run regedit on workstations, if that helps
I would suggest to reboot the server and enter into DSRM mode. Try to replace the GPO (copy the GUID from working backup) and reboot into normal mode. See if that helps?
Never implement changes in the default domain policy. Always make a new GPO for any changes you are considering. This also allows you to test against a machine/user in a test OU where the GPO is applied first to determine the behavior.
>MMC is an exe, and won't run
dcgpofix is an exe, and won't run.
No exe on the server will run

Try renaming those .exe's with a different extension ( ie dcgpofix.joe) after you make a backup copy of them in a different directory.
I've used this when virus software wouldn't let an executable run to clean up an infection.
Avatar of Nick67

ASKER

Alas, software restrictions are very smart.
They are designed to keep that very kind of skullduggery from working.
I tried.
No Dice.
ASKER CERTIFIED SOLUTION
Avatar of Nick67
Nick67
Flag of Canada image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Nick67

ASKER

Being blocked from running .exe on the server is a tricky chicken-and-egg problem.
The trick was remote registry editing, and not any Expert suggestion.