After being given "Hardening Windows Systems" for Christmas I decided to play
about with the local policy settings on my networked W2k Pro machine. I set
up a test group to check out the impact of denying local login, but, idiot
that I am, I accidentally chose the normal user group and now I can't get
back in !-(
I don't seem to be able to access the shared C drive from the network, but I
can login in as Admin from the recovery console. I tried doing a repair
install but, as I suspected, this didn't reset the policy.
Can anyone suggest a way of re-enabling local login? I can work from the
recovery console or I can boot into Linux and access the full C drive if
necessary.

StefanT

Re: Save me from my stupidity by Roger

Roger
Sun Dec 26 09:51:46 CST 2004

Hmmm, got bitten a little by that one ? At least we can get
you out of it, and it is likely one of the worst, for a machine
that is not a domain controller, that one can accident upon
while tightening a machine. Just remember that deny always
overrules a grant, and the Users, Authenticated Users, Everyone,
Network, and Interactive have wide impacts.

OK, so you need, as an admin, to locate your folder permissions
at system32\GroupPolicy and there set a Deny of full for the
Administrators group. Then, log off and back on, remove the
Deny you just set, and then immediately edit the local security
policies to remove the problem setting.
At a cmd prompt force refresh of policy (at prompt enter secedit
and go to the How to . . . refresh ), then log off and back in to see
if you are now set to go.

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"stefanT" <stefanT@discussions.microsoft.com> wrote in message
news:C3BF937E-61C3-4DE7-9930-F7E6449BF071@microsoft.com...
> After being given "Hardening Windows Systems" for Christmas I decided to
play
> about with the local policy settings on my networked W2k Pro machine. I
set
> up a test group to check out the impact of denying local login, but, idiot
> that I am, I accidentally chose the normal user group and now I can't get
> back in !-(
> I don't seem to be able to access the shared C drive from the network, but
I
> can login in as Admin from the recovery console. I tried doing a repair
> install but, as I suspected, this didn't reset the policy.
> Can anyone suggest a way of re-enabling local login? I can work from the
> recovery console or I can boot into Linux and access the full C drive if
> necessary.
>
> StefanT



Re: Save me from my stupidity by stefanT

stefanT
Tue Dec 28 05:57:02 CST 2004

Well and truly - grabbed by the short and curlys.
Before I start on the recovery I'd like to make sure I'm clear about what
I'm doing. As I understand it from the Local-Sec-Stngs/Loc-Pol -- GP/concepts
help, local policy is stored in a file (in ..\system32\GroupPolicy?) and
pulled into the registry at bootup. It sounds as though the fix is to hide
this from the registry when booting, correct the error and then pull it in by
refreshing the registry.
In order to do this I think you are advising to set the NTFS permissions on
.../Sys32/GP
to deny access for the admins group. If this is the case then I'm not sure
that I can do it - won't I need to be in Windows - or can I do this somehow
from the Recovery Console?

StefanT

"Roger Abell" wrote:

> Hmmm, got bitten a little by that one ? At least we can get
> you out of it, and it is likely one of the worst, for a machine
> that is not a domain controller, that one can accident upon
> while tightening a machine. Just remember that deny always
> overrules a grant, and the Users, Authenticated Users, Everyone,
> Network, and Interactive have wide impacts.
>
> OK, so you need, as an admin, to locate your folder permissions
> at system32\GroupPolicy and there set a Deny of full for the
> Administrators group. Then, log off and back on, remove the
> Deny you just set, and then immediately edit the local security
> policies to remove the problem setting.
> At a cmd prompt force refresh of policy (at prompt enter secedit
> and go to the How to . . . refresh ), then log off and back in to see
> if you are now set to go.
>
> --
> Roger Abell
> Microsoft MVP (Windows Security)
> MCSE (W2k3,W2k,Nt4) MCDBA
> "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> news:C3BF937E-61C3-4DE7-9930-F7E6449BF071@microsoft.com...
> > After being given "Hardening Windows Systems" for Christmas I decided to
> play
> > about with the local policy settings on my networked W2k Pro machine. I
> set
> > up a test group to check out the impact of denying local login, but, idiot
> > that I am, I accidentally chose the normal user group and now I can't get
> > back in !-(
> > I don't seem to be able to access the shared C drive from the network, but
> I
> > can login in as Admin from the recovery console. I tried doing a repair
> > install but, as I suspected, this didn't reset the policy.
> > Can anyone suggest a way of re-enabling local login? I can work from the
> > recovery console or I can boot into Linux and access the full C drive if
> > necessary.
> >
> > StefanT
>
>
>

Re: Save me from my stupidity by stefanT

stefanT
Tue Dec 28 16:57:04 CST 2004

OK. take #2

I find I can access via the network after all. So I navigate to
sysroot/sys32/GroupPolicy and set Deny on full for Administrators. I've not
logged in locally yet so I give it a try. No joy. I reboot the machine and
try again - still no joy. Same logon message - 'local policy does not permit
interactive logon'. Any thoughts?

What should the permissions be on this directory? Mine show
Admins : allow unset ; deny unset
System : allow unset ; deny unset
Everyone : allow full ; deny unset

The machine I'm working on was upgraded from W98 and the partition converted
to NTFS afterwards. I've got another W2k-Pro machine which had a Fat32
sysroot partition. I've just converted that to NTFS and that shows the same
permissions as well. Somehow, though, it doesn't feel quite right to have
full permissions for Everyone and no permissions for Admins or System.

StefanT

"stefanT" wrote:

> Well and truly - grabbed by the short and curlys.
snip....
>
> StefanT
>
> "Roger Abell" wrote:
>
> > Hmmm, got bitten a little by that one ? At least we can get
> > you out of it, and it is likely one of the worst, for a machine
> > that is not a domain controller, that one can accident upon
> > while tightening a machine. Just remember that deny always
> > overrules a grant, and the Users, Authenticated Users, Everyone,
> > Network, and Interactive have wide impacts.
> >
> > OK, so you need, as an admin, to locate your folder permissions
> > at system32\GroupPolicy and there set a Deny of full for the
> > Administrators group. Then, log off and back on, remove the
> > Deny you just set, and then immediately edit the local security
> > policies to remove the problem setting.
> > At a cmd prompt force refresh of policy (at prompt enter secedit
> > and go to the How to . . . refresh ), then log off and back in to see
> > if you are now set to go.
> >
> > --
> > Roger Abell
> > Microsoft MVP (Windows Security)
> > MCSE (W2k3,W2k,Nt4) MCDBA
> > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> > news:C3BF937E-61C3-4DE7-9930-F7E6449BF071@microsoft.com...
> > > After being given "Hardening Windows Systems" for Christmas I decided to
> > play
> > > about with the local policy settings on my networked W2k Pro machine.
snip...
> > > StefanT
> >
> >
> >

Re: Save me from my stupidity by Roger

Roger
Tue Dec 28 18:22:37 CST 2004

Windows 2000 and earlier did not set NTFS permissions on
directories that were from upgrade installs, or converted to
NTFS from FAT.
The registry part of what you were saying is behind the scenes.
What is important is the the system32\GroupPolicy folder is
not readable by the account logging in so that policy will not
be applied to it. I have never had someone not have this work
for them when in your situation, at least as I hear your description
of the situation. 100% success until now. So, are you sure that
the Deny of full control for administrators was saved, and perhaps
check that it propagated onto the contents of the folder.
The "normal" permissions for the folder in Windows 2000 (server)
are grants of Administrators Full ; SYSTEM Full; and Authenticated
Users Read&Execute (and so List+Read)

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"stefanT" <stefanT@discussions.microsoft.com> wrote in message
news:C9ADAD1D-1D45-4565-9BBE-C79F4E029C6F@microsoft.com...
> OK. take #2
>
> I find I can access via the network after all. So I navigate to
> sysroot/sys32/GroupPolicy and set Deny on full for Administrators. I've
not
> logged in locally yet so I give it a try. No joy. I reboot the machine
and
> try again - still no joy. Same logon message - 'local policy does not
permit
> interactive logon'. Any thoughts?
>
> What should the permissions be on this directory? Mine show
> Admins : allow unset ; deny unset
> System : allow unset ; deny unset
> Everyone : allow full ; deny unset
>
> The machine I'm working on was upgraded from W98 and the partition
converted
> to NTFS afterwards. I've got another W2k-Pro machine which had a Fat32
> sysroot partition. I've just converted that to NTFS and that shows the
same
> permissions as well. Somehow, though, it doesn't feel quite right to have
> full permissions for Everyone and no permissions for Admins or System.
>
> StefanT
>
> "stefanT" wrote:
>
> > Well and truly - grabbed by the short and curlys.
> snip....
> >
> > StefanT
> >
> > "Roger Abell" wrote:
> >
> > > Hmmm, got bitten a little by that one ? At least we can get
> > > you out of it, and it is likely one of the worst, for a machine
> > > that is not a domain controller, that one can accident upon
> > > while tightening a machine. Just remember that deny always
> > > overrules a grant, and the Users, Authenticated Users, Everyone,
> > > Network, and Interactive have wide impacts.
> > >
> > > OK, so you need, as an admin, to locate your folder permissions
> > > at system32\GroupPolicy and there set a Deny of full for the
> > > Administrators group. Then, log off and back on, remove the
> > > Deny you just set, and then immediately edit the local security
> > > policies to remove the problem setting.
> > > At a cmd prompt force refresh of policy (at prompt enter secedit
> > > and go to the How to . . . refresh ), then log off and back in to see
> > > if you are now set to go.
> > >
> > > --
> > > Roger Abell
> > > Microsoft MVP (Windows Security)
> > > MCSE (W2k3,W2k,Nt4) MCDBA
> > > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> > > news:C3BF937E-61C3-4DE7-9930-F7E6449BF071@microsoft.com...
> > > > After being given "Hardening Windows Systems" for Christmas I
decided to
> > > play
> > > > about with the local policy settings on my networked W2k Pro
machine.
> snip...
> > > > StefanT
> > >
> > >
> > >



Re: Save me from my stupidity by stefanT

stefanT
Thu Dec 30 12:21:03 CST 2004

99.9% sure. However, to be certain, via the network C drive share I removed
'Everyone', added 'AuthenticatedUsers' and set the permissions to:
Adminstrators : deny full
System : deny full
AuthenticatedUsers : deny full
The sub-directories and contents were also explicitly set to deny full for
all three.
The deny full for A-Users worked because I could no longer access the
GroupPolicy directory so I guess the same applies to Admins.
Despite this, I could still not login locally.

If, from what you say, this fix should work, there must be something
anomolous with the system. Just to recapitulate, it's running W2k-Pro - no
SPs and was setup as a Workgroup PC. The only change I made was to deny
local login to group Users. I attempted to do a repair re-install at which
point I changed it to a Domain PC to try and login to the domain, but the
re-install did not complete and I had to reboot. The machine came back up OK
with only the local login prompt.

The login authentication seems to be OK since an incorrect user or password
produces a normal logon failure message.

The only thing I have observed whenever I tried to login was that the sam &
sam.log files in sys32/config are updated.

If this fix cannot be made to work, would there be another way to approach
it if I did a parallel installation - say by copying the relevent files from
that installation? I rather get the feeling that this problem is going to
take some experimenting in order to locate the cause. My problem is, I know
virtually nothing about the inner workings in order to do this. At the end
of the day, I can always do a full re-install, tho' I'd rather avoid this if
I can. What I don't want to do is waste your time on what could be a
fruitless chase - so if you want to sign off on this then go ahead - I'll
understand. I spent several years providing international support at the end
of a telephone so I know what a bummer this kind of thing can be.

StefanT

"Roger Abell" wrote:

> Windows 2000 and earlier did not set NTFS permissions on
> directories that were from upgrade installs, or converted to
> NTFS from FAT.
> The registry part of what you were saying is behind the scenes.
> What is important is the the system32\GroupPolicy folder is
> not readable by the account logging in so that policy will not
> be applied to it. I have never had someone not have this work
> for them when in your situation, at least as I hear your description
> of the situation. 100% success until now. So, are you sure that
> the Deny of full control for administrators was saved, and perhaps
> check that it propagated onto the contents of the folder.
> The "normal" permissions for the folder in Windows 2000 (server)
> are grants of Administrators Full ; SYSTEM Full; and Authenticated
> Users Read&Execute (and so List+Read)
>
> --
> Roger Abell
> Microsoft MVP (Windows Security)
> MCSE (W2k3,W2k,Nt4) MCDBA
> "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> news:C9ADAD1D-1D45-4565-9BBE-C79F4E029C6F@microsoft.com...
> > OK. take #2
> >
> > I find I can access via the network after all. So I navigate to
> > sysroot/sys32/GroupPolicy and set Deny on full for Administrators. I've
> not
> > logged in locally yet so I give it a try. No joy. I reboot the machine
> and
> > try again - still no joy. Same logon message - 'local policy does not
> permit
> > interactive logon'. Any thoughts?
> >
> > What should the permissions be on this directory? Mine show
> > Admins : allow unset ; deny unset
> > System : allow unset ; deny unset
> > Everyone : allow full ; deny unset
> >
>>snip

Re: Save me from my stupidity by Roger

Roger
Fri Dec 31 04:28:53 CST 2004

Well, that is rather a surprise Stefan and it does seem to indicate
that there may be something else operative here. I must add that
you comment of W2k with no service packs installed does not
sound encouraging as such a machine usually will become heavily
compromised in a very short time if connected to the open network.
Since the tweak of GroupPolicy is not effective you should just set
it back to what it was.
You could try seeing whether remote use of NTrights.exe helps
http://support.microsoft.com/default.aspx?scid=kb;en-us;279664
You should try this logged into the machine where the tool runs
using a account that matches in name and password an admin
account on the machine that has the problem.
You should be able to but apparently cannot get NTrights by following
the Tools linkpath from
http://www.microsoft.com/windows2000/techinfo/reskit/default.asp
and I also do not find a link searching microsoft.com/downloads
so you may have to do some hunting to find this, as I do not find
the W2k version available. However, you might find the W2k3
version of use - no guarantees here of course, and you have not
mentioned if the other machine available is W2k, XP, or . . .
http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en
but these tools are for use on XP or W2k3 - I have not tried these
versions in W2k.
--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"stefanT" <stefanT@discussions.microsoft.com> wrote in message
news:999754A3-AAA5-4BDA-8D75-FC15F1FA6A12@microsoft.com...
> 99.9% sure. However, to be certain, via the network C drive share I
removed
> 'Everyone', added 'AuthenticatedUsers' and set the permissions to:
> Adminstrators : deny full
> System : deny full
> AuthenticatedUsers : deny full
> The sub-directories and contents were also explicitly set to deny full for
> all three.
> The deny full for A-Users worked because I could no longer access the
> GroupPolicy directory so I guess the same applies to Admins.
> Despite this, I could still not login locally.
>
> If, from what you say, this fix should work, there must be something
> anomolous with the system. Just to recapitulate, it's running W2k-Pro -
no
> SPs and was setup as a Workgroup PC. The only change I made was to deny
> local login to group Users. I attempted to do a repair re-install at
which
> point I changed it to a Domain PC to try and login to the domain, but the
> re-install did not complete and I had to reboot. The machine came back up
OK
> with only the local login prompt.
>
> The login authentication seems to be OK since an incorrect user or
password
> produces a normal logon failure message.
>
> The only thing I have observed whenever I tried to login was that the sam
&
> sam.log files in sys32/config are updated.
>
> If this fix cannot be made to work, would there be another way to approach
> it if I did a parallel installation - say by copying the relevent files
from
> that installation? I rather get the feeling that this problem is going to
> take some experimenting in order to locate the cause. My problem is, I
know
> virtually nothing about the inner workings in order to do this. At the
end
> of the day, I can always do a full re-install, tho' I'd rather avoid this
if
> I can. What I don't want to do is waste your time on what could be a
> fruitless chase - so if you want to sign off on this then go ahead - I'll
> understand. I spent several years providing international support at the
end
> of a telephone so I know what a bummer this kind of thing can be.
>
> StefanT
>
> "Roger Abell" wrote:
>
> > Windows 2000 and earlier did not set NTFS permissions on
> > directories that were from upgrade installs, or converted to
> > NTFS from FAT.
> > The registry part of what you were saying is behind the scenes.
> > What is important is the the system32\GroupPolicy folder is
> > not readable by the account logging in so that policy will not
> > be applied to it. I have never had someone not have this work
> > for them when in your situation, at least as I hear your description
> > of the situation. 100% success until now. So, are you sure that
> > the Deny of full control for administrators was saved, and perhaps
> > check that it propagated onto the contents of the folder.
> > The "normal" permissions for the folder in Windows 2000 (server)
> > are grants of Administrators Full ; SYSTEM Full; and Authenticated
> > Users Read&Execute (and so List+Read)
> >
> > --
> > Roger Abell
> > Microsoft MVP (Windows Security)
> > MCSE (W2k3,W2k,Nt4) MCDBA
> > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> > news:C9ADAD1D-1D45-4565-9BBE-C79F4E029C6F@microsoft.com...
> > > OK. take #2
> > >
> > > I find I can access via the network after all. So I navigate to
> > > sysroot/sys32/GroupPolicy and set Deny on full for Administrators.
I've
> > not
> > > logged in locally yet so I give it a try. No joy. I reboot the
machine
> > and
> > > try again - still no joy. Same logon message - 'local policy does not
> > permit
> > > interactive logon'. Any thoughts?
> > >
> > > What should the permissions be on this directory? Mine show
> > > Admins : allow unset ; deny unset
> > > System : allow unset ; deny unset
> > > Everyone : allow full ; deny unset
> > >
> >>snip



Re: Save me from my stupidity by Steven

Steven
Fri Dec 31 11:33:24 CST 2004

Ntrights is available at the link below. Of course anyone attempting to use
it needs to know that the user right used in the command is case sensitive.
The problem could be a lack of the logon locally user right or that a group
the user is in [everyone, users] has in the deny logon locally user
ight. --- Steve

http://www.petri.co.il/download_free_reskit_tools.htm

[ ntrights -m \\mycomputer +r SeInteractiveLogonRight -u users ] for
instance to grant users logon locally user right over the network to
computer named my computer. Of course you would need to be logged onto
source computer with an account that is an administrator on target locked
out computer and have the user right for access this computer from the
network on the locked out computer.


"Roger Abell" <mvpNOSpam@asu.edu> wrote in message
news:u1IfmMy7EHA.2568@TK2MSFTNGP10.phx.gbl...
> Well, that is rather a surprise Stefan and it does seem to indicate
> that there may be something else operative here. I must add that
> you comment of W2k with no service packs installed does not
> sound encouraging as such a machine usually will become heavily
> compromised in a very short time if connected to the open network.
> Since the tweak of GroupPolicy is not effective you should just set
> it back to what it was.
> You could try seeing whether remote use of NTrights.exe helps
> http://support.microsoft.com/default.aspx?scid=kb;en-us;279664
> You should try this logged into the machine where the tool runs
> using a account that matches in name and password an admin
> account on the machine that has the problem.
> You should be able to but apparently cannot get NTrights by following
> the Tools linkpath from
> http://www.microsoft.com/windows2000/techinfo/reskit/default.asp
> and I also do not find a link searching microsoft.com/downloads
> so you may have to do some hunting to find this, as I do not find
> the W2k version available. However, you might find the W2k3
> version of use - no guarantees here of course, and you have not
> mentioned if the other machine available is W2k, XP, or . . .
> http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en
> but these tools are for use on XP or W2k3 - I have not tried these
> versions in W2k.
> --
> Roger Abell
> Microsoft MVP (Windows Security)
> MCSE (W2k3,W2k,Nt4) MCDBA
> "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> news:999754A3-AAA5-4BDA-8D75-FC15F1FA6A12@microsoft.com...
>> 99.9% sure. However, to be certain, via the network C drive share I
> removed
>> 'Everyone', added 'AuthenticatedUsers' and set the permissions to:
>> Adminstrators : deny full
>> System : deny full
>> AuthenticatedUsers : deny full
>> The sub-directories and contents were also explicitly set to deny full
>> for
>> all three.
>> The deny full for A-Users worked because I could no longer access the
>> GroupPolicy directory so I guess the same applies to Admins.
>> Despite this, I could still not login locally.
>>
>> If, from what you say, this fix should work, there must be something
>> anomolous with the system. Just to recapitulate, it's running W2k-Pro -
> no
>> SPs and was setup as a Workgroup PC. The only change I made was to deny
>> local login to group Users. I attempted to do a repair re-install at
> which
>> point I changed it to a Domain PC to try and login to the domain, but the
>> re-install did not complete and I had to reboot. The machine came back up
> OK
>> with only the local login prompt.
>>
>> The login authentication seems to be OK since an incorrect user or
> password
>> produces a normal logon failure message.
>>
>> The only thing I have observed whenever I tried to login was that the sam
> &
>> sam.log files in sys32/config are updated.
>>
>> If this fix cannot be made to work, would there be another way to
>> approach
>> it if I did a parallel installation - say by copying the relevent files
> from
>> that installation? I rather get the feeling that this problem is going
>> to
>> take some experimenting in order to locate the cause. My problem is, I
> know
>> virtually nothing about the inner workings in order to do this. At the
> end
>> of the day, I can always do a full re-install, tho' I'd rather avoid this
> if
>> I can. What I don't want to do is waste your time on what could be a
>> fruitless chase - so if you want to sign off on this then go ahead - I'll
>> understand. I spent several years providing international support at the
> end
>> of a telephone so I know what a bummer this kind of thing can be.
>>
>> StefanT
>>
>> "Roger Abell" wrote:
>>
>> > Windows 2000 and earlier did not set NTFS permissions on
>> > directories that were from upgrade installs, or converted to
>> > NTFS from FAT.
>> > The registry part of what you were saying is behind the scenes.
>> > What is important is the the system32\GroupPolicy folder is
>> > not readable by the account logging in so that policy will not
>> > be applied to it. I have never had someone not have this work
>> > for them when in your situation, at least as I hear your description
>> > of the situation. 100% success until now. So, are you sure that
>> > the Deny of full control for administrators was saved, and perhaps
>> > check that it propagated onto the contents of the folder.
>> > The "normal" permissions for the folder in Windows 2000 (server)
>> > are grants of Administrators Full ; SYSTEM Full; and Authenticated
>> > Users Read&Execute (and so List+Read)
>> >
>> > --
>> > Roger Abell
>> > Microsoft MVP (Windows Security)
>> > MCSE (W2k3,W2k,Nt4) MCDBA
>> > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
>> > news:C9ADAD1D-1D45-4565-9BBE-C79F4E029C6F@microsoft.com...
>> > > OK. take #2
>> > >
>> > > I find I can access via the network after all. So I navigate to
>> > > sysroot/sys32/GroupPolicy and set Deny on full for Administrators.
> I've
>> > not
>> > > logged in locally yet so I give it a try. No joy. I reboot the
> machine
>> > and
>> > > try again - still no joy. Same logon message - 'local policy does
>> > > not
>> > permit
>> > > interactive logon'. Any thoughts?
>> > >
>> > > What should the permissions be on this directory? Mine show
>> > > Admins : allow unset ; deny unset
>> > > System : allow unset ; deny unset
>> > > Everyone : allow full ; deny unset
>> > >
>> >>snip
>
>



Re: Save me from my stupidity by stefanT

stefanT
Sat Jan 01 08:11:02 CST 2005

It worked :^).

I initially tried "ntrights -m \\mycomputer +r SeInteractiveLogonRight -u
users" but this failed and then I remembered that Deny overides Allow.

"ntrights -m \\mycomputer -r SeDenyInteractiveLogonRight -u users" did the
trick.

Thank you very much for your help and your patience gentlemen. Have a happy
new year.

StefanT

"Steven L Umbach" wrote:

> Ntrights is available at the link below. Of course anyone attempting to use
> it needs to know that the user right used in the command is case sensitive.
> The problem could be a lack of the logon locally user right or that a group
> the user is in [everyone, users] has in the deny logon locally user
> ight. --- Steve
>
> http://www.petri.co.il/download_free_reskit_tools.htm
>
> [ ntrights -m \\mycomputer +r SeInteractiveLogonRight -u users ] for
> instance to grant users logon locally user right over the network to
> computer named my computer. Of course you would need to be logged onto
> source computer with an account that is an administrator on target locked
> out computer and have the user right for access this computer from the
> network on the locked out computer.
>
>
> "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
> news:u1IfmMy7EHA.2568@TK2MSFTNGP10.phx.gbl...
> > Well, that is rather a surprise Stefan and it does seem to indicate
> > that there may be something else operative here. I must add that
> > you comment of W2k with no service packs installed does not
> > sound encouraging as such a machine usually will become heavily
> > compromised in a very short time if connected to the open network.
> > Since the tweak of GroupPolicy is not effective you should just set
> > it back to what it was.
> > You could try seeing whether remote use of NTrights.exe helps
> > http://support.microsoft.com/default.aspx?scid=kb;en-us;279664
> > You should try this logged into the machine where the tool runs
> > using a account that matches in name and password an admin
> > account on the machine that has the problem.
> > You should be able to but apparently cannot get NTrights by following
> > the Tools linkpath from
> > http://www.microsoft.com/windows2000/techinfo/reskit/default.asp
> > and I also do not find a link searching microsoft.com/downloads
> > so you may have to do some hunting to find this, as I do not find
> > the W2k version available. However, you might find the W2k3
> > version of use - no guarantees here of course, and you have not
> > mentioned if the other machine available is W2k, XP, or . . .
> > http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en
> > but these tools are for use on XP or W2k3 - I have not tried these
> > versions in W2k.
> > --
> > Roger Abell
> > Microsoft MVP (Windows Security)
> > MCSE (W2k3,W2k,Nt4) MCDBA
> > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> > news:999754A3-AAA5-4BDA-8D75-FC15F1FA6A12@microsoft.com...
> >> 99.9% sure. However, to be certain, via the network C drive share I
> > removed
> >> 'Everyone', added 'AuthenticatedUsers' and set the permissions to:
> >> Adminstrators : deny full
> >> System : deny full
> >> AuthenticatedUsers : deny full
> >> The sub-directories and contents were also explicitly set to deny full
> >> for
> >> all three.
> >> The deny full for A-Users worked because I could no longer access the
> >> GroupPolicy directory so I guess the same applies to Admins.
> >> Despite this, I could still not login locally.
> >>
> >> If, from what you say, this fix should work, there must be something
> >> anomolous with the system. Just to recapitulate, it's running W2k-Pro -
> > no
> >> SPs and was setup as a Workgroup PC. The only change I made was to deny
> >> local login to group Users. I attempted to do a repair re-install at
> > which
> >> point I changed it to a Domain PC to try and login to the domain, but the
> >> re-install did not complete and I had to reboot. The machine came back up
> > OK
> >> with only the local login prompt.
> >>
> >> The login authentication seems to be OK since an incorrect user or
> > password
> >> produces a normal logon failure message.
> >>
> >> The only thing I have observed whenever I tried to login was that the sam
> > &
> >> sam.log files in sys32/config are updated.
> >>
> >> If this fix cannot be made to work, would there be another way to
> >> approach
> >> it if I did a parallel installation - say by copying the relevent files
> > from
> >> that installation? I rather get the feeling that this problem is going
> >> to
> >> take some experimenting in order to locate the cause. My problem is, I
> > know
> >> virtually nothing about the inner workings in order to do this. At the
> > end
> >> of the day, I can always do a full re-install, tho' I'd rather avoid this
> > if
> >> I can. What I don't want to do is waste your time on what could be a
> >> fruitless chase - so if you want to sign off on this then go ahead - I'll
> >> understand. I spent several years providing international support at the
> > end
> >> of a telephone so I know what a bummer this kind of thing can be.
> >>
> >> StefanT
> >>
> >> "Roger Abell" wrote:
> >>
> >> > Windows 2000 and earlier did not set NTFS permissions on
> >> > directories that were from upgrade installs, or converted to
> >> > NTFS from FAT.
> >> > The registry part of what you were saying is behind the scenes.
> >> > What is important is the the system32\GroupPolicy folder is
> >> > not readable by the account logging in so that policy will not
> >> > be applied to it. I have never had someone not have this work
> >> > for them when in your situation, at least as I hear your description
> >> > of the situation. 100% success until now. So, are you sure that
> >> > the Deny of full control for administrators was saved, and perhaps
> >> > check that it propagated onto the contents of the folder.
> >> > The "normal" permissions for the folder in Windows 2000 (server)
> >> > are grants of Administrators Full ; SYSTEM Full; and Authenticated
> >> > Users Read&Execute (and so List+Read)
> >> >
> >> > --
> >> > Roger Abell
> >> > Microsoft MVP (Windows Security)
> >> > MCSE (W2k3,W2k,Nt4) MCDBA
> >> > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> >> > news:C9ADAD1D-1D45-4565-9BBE-C79F4E029C6F@microsoft.com...
> >> > > OK. take #2
> >> > >
> >> > > I find I can access via the network after all. So I navigate to
> >> > > sysroot/sys32/GroupPolicy and set Deny on full for Administrators.
> > I've
> >> > not
> >> > > logged in locally yet so I give it a try. No joy. I reboot the
> > machine
> >> > and
> >> > > try again - still no joy. Same logon message - 'local policy does
> >> > > not
> >> > permit
> >> > > interactive logon'. Any thoughts?
> >> > >
> >> > > What should the permissions be on this directory? Mine show
> >> > > Admins : allow unset ; deny unset
> >> > > System : allow unset ; deny unset
> >> > > Everyone : allow full ; deny unset
> >> > >
> >> >>snip
> >
> >
>
>
>

Re: Save me from my stupidity by Roger

Roger
Sat Jan 01 09:09:09 CST 2005

Great. Sorry I routed you down a long path.

--
Roger
"stefanT" <stefanT@discussions.microsoft.com> wrote in message
news:0ACA8CB7-2E58-4E9F-893E-7083BB708FFC@microsoft.com...
> It worked :^).
>
> I initially tried "ntrights -m \\mycomputer +r SeInteractiveLogonRight -u
> users" but this failed and then I remembered that Deny overides Allow.
>
> "ntrights -m \\mycomputer -r SeDenyInteractiveLogonRight -u users" did
the
> trick.
>
> Thank you very much for your help and your patience gentlemen. Have a
happy
> new year.
>
> StefanT
>
> "Steven L Umbach" wrote:
>
> > Ntrights is available at the link below. Of course anyone attempting to
use
> > it needs to know that the user right used in the command is case
sensitive.
> > The problem could be a lack of the logon locally user right or that a
group
> > the user is in [everyone, users] has in the deny logon locally user
> > ight. --- Steve
> >
> > http://www.petri.co.il/download_free_reskit_tools.htm
> >
> > [ ntrights -m \\mycomputer +r SeInteractiveLogonRight -u users ] for
> > instance to grant users logon locally user right over the network to
> > computer named my computer. Of course you would need to be logged onto
> > source computer with an account that is an administrator on target
locked
> > out computer and have the user right for access this computer from the
> > network on the locked out computer.
> >
> >
> > "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
> > news:u1IfmMy7EHA.2568@TK2MSFTNGP10.phx.gbl...
> > > Well, that is rather a surprise Stefan and it does seem to indicate
> > > that there may be something else operative here. I must add that
> > > you comment of W2k with no service packs installed does not
> > > sound encouraging as such a machine usually will become heavily
> > > compromised in a very short time if connected to the open network.
> > > Since the tweak of GroupPolicy is not effective you should just set
> > > it back to what it was.
> > > You could try seeing whether remote use of NTrights.exe helps
> > > http://support.microsoft.com/default.aspx?scid=kb;en-us;279664
> > > You should try this logged into the machine where the tool runs
> > > using a account that matches in name and password an admin
> > > account on the machine that has the problem.
> > > You should be able to but apparently cannot get NTrights by following
> > > the Tools linkpath from
> > > http://www.microsoft.com/windows2000/techinfo/reskit/default.asp
> > > and I also do not find a link searching microsoft.com/downloads
> > > so you may have to do some hunting to find this, as I do not find
> > > the W2k version available. However, you might find the W2k3
> > > version of use - no guarantees here of course, and you have not
> > > mentioned if the other machine available is W2k, XP, or . . .
> > >
http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en
> > > but these tools are for use on XP or W2k3 - I have not tried these
> > > versions in W2k.
> > > --
> > > Roger Abell
> > > Microsoft MVP (Windows Security)
> > > MCSE (W2k3,W2k,Nt4) MCDBA
> > > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> > > news:999754A3-AAA5-4BDA-8D75-FC15F1FA6A12@microsoft.com...
> > >> 99.9% sure. However, to be certain, via the network C drive share I
> > > removed
> > >> 'Everyone', added 'AuthenticatedUsers' and set the permissions to:
> > >> Adminstrators : deny full
> > >> System : deny full
> > >> AuthenticatedUsers : deny full
> > >> The sub-directories and contents were also explicitly set to deny
full
> > >> for
> > >> all three.
> > >> The deny full for A-Users worked because I could no longer access the
> > >> GroupPolicy directory so I guess the same applies to Admins.
> > >> Despite this, I could still not login locally.
> > >>
> > >> If, from what you say, this fix should work, there must be something
> > >> anomolous with the system. Just to recapitulate, it's running
W2k-Pro -
> > > no
> > >> SPs and was setup as a Workgroup PC. The only change I made was to
deny
> > >> local login to group Users. I attempted to do a repair re-install at
> > > which
> > >> point I changed it to a Domain PC to try and login to the domain, but
the
> > >> re-install did not complete and I had to reboot. The machine came
back up
> > > OK
> > >> with only the local login prompt.
> > >>
> > >> The login authentication seems to be OK since an incorrect user or
> > > password
> > >> produces a normal logon failure message.
> > >>
> > >> The only thing I have observed whenever I tried to login was that the
sam
> > > &
> > >> sam.log files in sys32/config are updated.
> > >>
> > >> If this fix cannot be made to work, would there be another way to
> > >> approach
> > >> it if I did a parallel installation - say by copying the relevent
files
> > > from
> > >> that installation? I rather get the feeling that this problem is
going
> > >> to
> > >> take some experimenting in order to locate the cause. My problem is,
I
> > > know
> > >> virtually nothing about the inner workings in order to do this. At
the
> > > end
> > >> of the day, I can always do a full re-install, tho' I'd rather avoid
this
> > > if
> > >> I can. What I don't want to do is waste your time on what could be a
> > >> fruitless chase - so if you want to sign off on this then go ahead -
I'll
> > >> understand. I spent several years providing international support at
the
> > > end
> > >> of a telephone so I know what a bummer this kind of thing can be.
> > >>
> > >> StefanT
> > >>
> > >> "Roger Abell" wrote:
> > >>
> > >> > Windows 2000 and earlier did not set NTFS permissions on
> > >> > directories that were from upgrade installs, or converted to
> > >> > NTFS from FAT.
> > >> > The registry part of what you were saying is behind the scenes.
> > >> > What is important is the the system32\GroupPolicy folder is
> > >> > not readable by the account logging in so that policy will not
> > >> > be applied to it. I have never had someone not have this work
> > >> > for them when in your situation, at least as I hear your
description
> > >> > of the situation. 100% success until now. So, are you sure that
> > >> > the Deny of full control for administrators was saved, and perhaps
> > >> > check that it propagated onto the contents of the folder.
> > >> > The "normal" permissions for the folder in Windows 2000 (server)
> > >> > are grants of Administrators Full ; SYSTEM Full; and Authenticated
> > >> > Users Read&Execute (and so List+Read)
> > >> >
> > >> > --
> > >> > Roger Abell
> > >> > Microsoft MVP (Windows Security)
> > >> > MCSE (W2k3,W2k,Nt4) MCDBA
> > >> > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> > >> > news:C9ADAD1D-1D45-4565-9BBE-C79F4E029C6F@microsoft.com...
> > >> > > OK. take #2
> > >> > >
> > >> > > I find I can access via the network after all. So I navigate to
> > >> > > sysroot/sys32/GroupPolicy and set Deny on full for
Administrators.
> > > I've
> > >> > not
> > >> > > logged in locally yet so I give it a try. No joy. I reboot the
> > > machine
> > >> > and
> > >> > > try again - still no joy. Same logon message - 'local policy
does
> > >> > > not
> > >> > permit
> > >> > > interactive logon'. Any thoughts?
> > >> > >
> > >> > > What should the permissions be on this directory? Mine show
> > >> > > Admins : allow unset ; deny unset
> > >> > > System : allow unset ; deny unset
> > >> > > Everyone : allow full ; deny unset
> > >> > >
> > >> >>snip
> > >
> > >
> >
> >
> >



Re: Save me from my stupidity by Roger

Roger
Sat Jan 01 09:10:12 CST 2005

Hi Steve,

Any ideas why the old standard use of Deny over the
GroupPolicy folder did not work this time ??

--
Roger
"Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
news:E3gBd.49912$k25.23013@attbi_s53...
> Ntrights is available at the link below. Of course anyone attempting to
use
> it needs to know that the user right used in the command is case
sensitive.
> The problem could be a lack of the logon locally user right or that a
group
> the user is in [everyone, users] has in the deny logon locally user
> ight. --- Steve
>
> http://www.petri.co.il/download_free_reskit_tools.htm
>
> [ ntrights -m \\mycomputer +r SeInteractiveLogonRight -u users ] for
> instance to grant users logon locally user right over the network to
> computer named my computer. Of course you would need to be logged onto
> source computer with an account that is an administrator on target locked
> out computer and have the user right for access this computer from the
> network on the locked out computer.
>
>
> "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
> news:u1IfmMy7EHA.2568@TK2MSFTNGP10.phx.gbl...
> > Well, that is rather a surprise Stefan and it does seem to indicate
> > that there may be something else operative here. I must add that
> > you comment of W2k with no service packs installed does not
> > sound encouraging as such a machine usually will become heavily
> > compromised in a very short time if connected to the open network.
> > Since the tweak of GroupPolicy is not effective you should just set
> > it back to what it was.
> > You could try seeing whether remote use of NTrights.exe helps
> > http://support.microsoft.com/default.aspx?scid=kb;en-us;279664
> > You should try this logged into the machine where the tool runs
> > using a account that matches in name and password an admin
> > account on the machine that has the problem.
> > You should be able to but apparently cannot get NTrights by following
> > the Tools linkpath from
> > http://www.microsoft.com/windows2000/techinfo/reskit/default.asp
> > and I also do not find a link searching microsoft.com/downloads
> > so you may have to do some hunting to find this, as I do not find
> > the W2k version available. However, you might find the W2k3
> > version of use - no guarantees here of course, and you have not
> > mentioned if the other machine available is W2k, XP, or . . .
> >
http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en
> > but these tools are for use on XP or W2k3 - I have not tried these
> > versions in W2k.
> > --
> > Roger Abell
> > Microsoft MVP (Windows Security)
> > MCSE (W2k3,W2k,Nt4) MCDBA
> > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> > news:999754A3-AAA5-4BDA-8D75-FC15F1FA6A12@microsoft.com...
> >> 99.9% sure. However, to be certain, via the network C drive share I
> > removed
> >> 'Everyone', added 'AuthenticatedUsers' and set the permissions to:
> >> Adminstrators : deny full
> >> System : deny full
> >> AuthenticatedUsers : deny full
> >> The sub-directories and contents were also explicitly set to deny full
> >> for
> >> all three.
> >> The deny full for A-Users worked because I could no longer access the
> >> GroupPolicy directory so I guess the same applies to Admins.
> >> Despite this, I could still not login locally.
> >>
> >> If, from what you say, this fix should work, there must be something
> >> anomolous with the system. Just to recapitulate, it's running
W2k-Pro -
> > no
> >> SPs and was setup as a Workgroup PC. The only change I made was to
deny
> >> local login to group Users. I attempted to do a repair re-install at
> > which
> >> point I changed it to a Domain PC to try and login to the domain, but
the
> >> re-install did not complete and I had to reboot. The machine came back
up
> > OK
> >> with only the local login prompt.
> >>
> >> The login authentication seems to be OK since an incorrect user or
> > password
> >> produces a normal logon failure message.
> >>
> >> The only thing I have observed whenever I tried to login was that the
sam
> > &
> >> sam.log files in sys32/config are updated.
> >>
> >> If this fix cannot be made to work, would there be another way to
> >> approach
> >> it if I did a parallel installation - say by copying the relevent files
> > from
> >> that installation? I rather get the feeling that this problem is going
> >> to
> >> take some experimenting in order to locate the cause. My problem is, I
> > know
> >> virtually nothing about the inner workings in order to do this. At the
> > end
> >> of the day, I can always do a full re-install, tho' I'd rather avoid
this
> > if
> >> I can. What I don't want to do is waste your time on what could be a
> >> fruitless chase - so if you want to sign off on this then go ahead -
I'll
> >> understand. I spent several years providing international support at
the
> > end
> >> of a telephone so I know what a bummer this kind of thing can be.
> >>
> >> StefanT
> >>
> >> "Roger Abell" wrote:
> >>
> >> > Windows 2000 and earlier did not set NTFS permissions on
> >> > directories that were from upgrade installs, or converted to
> >> > NTFS from FAT.
> >> > The registry part of what you were saying is behind the scenes.
> >> > What is important is the the system32\GroupPolicy folder is
> >> > not readable by the account logging in so that policy will not
> >> > be applied to it. I have never had someone not have this work
> >> > for them when in your situation, at least as I hear your description
> >> > of the situation. 100% success until now. So, are you sure that
> >> > the Deny of full control for administrators was saved, and perhaps
> >> > check that it propagated onto the contents of the folder.
> >> > The "normal" permissions for the folder in Windows 2000 (server)
> >> > are grants of Administrators Full ; SYSTEM Full; and Authenticated
> >> > Users Read&Execute (and so List+Read)
> >> >
> >> > --
> >> > Roger Abell
> >> > Microsoft MVP (Windows Security)
> >> > MCSE (W2k3,W2k,Nt4) MCDBA
> >> > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
> >> > news:C9ADAD1D-1D45-4565-9BBE-C79F4E029C6F@microsoft.com...
> >> > > OK. take #2
> >> > >
> >> > > I find I can access via the network after all. So I navigate to
> >> > > sysroot/sys32/GroupPolicy and set Deny on full for Administrators.
> > I've
> >> > not
> >> > > logged in locally yet so I give it a try. No joy. I reboot the
> > machine
> >> > and
> >> > > try again - still no joy. Same logon message - 'local policy does
> >> > > not
> >> > permit
> >> > > interactive logon'. Any thoughts?
> >> > >
> >> > > What should the permissions be on this directory? Mine show
> >> > > Admins : allow unset ; deny unset
> >> > > System : allow unset ; deny unset
> >> > > Everyone : allow full ; deny unset
> >> > >
> >> >>snip
> >
> >
>
>



Re: Save me from my stupidity by Steven

Steven
Sat Jan 01 11:28:50 CST 2005

Happy New Year Roger.

My we are up early!

I have never actually tried that for computer configuration policy. It works
great for blocking user configuration. I will have to play around with it to
see what I can find out. Maybe the disqualifier "results may vary" applies
in this case. --- Steve


"Roger Abell" <mvpNOSpam@asu.edu> wrote in message
news:%23CipbOB8EHA.2608@TK2MSFTNGP10.phx.gbl...
> Hi Steve,
>
> Any ideas why the old standard use of Deny over the
> GroupPolicy folder did not work this time ??
>
> --
> Roger
> "Steven L Umbach" <n9rou@n0-spam-for-me-comcast.net> wrote in message
> news:E3gBd.49912$k25.23013@attbi_s53...
>> Ntrights is available at the link below. Of course anyone attempting to
> use
>> it needs to know that the user right used in the command is case
> sensitive.
>> The problem could be a lack of the logon locally user right or that a
> group
>> the user is in [everyone, users] has in the deny logon locally user
>> ight. --- Steve
>>
>> http://www.petri.co.il/download_free_reskit_tools.htm
>>
>> [ ntrights -m \\mycomputer +r SeInteractiveLogonRight -u users ] for
>> instance to grant users logon locally user right over the network to
>> computer named my computer. Of course you would need to be logged onto
>> source computer with an account that is an administrator on target locked
>> out computer and have the user right for access this computer from the
>> network on the locked out computer.
>>
>>
>> "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
>> news:u1IfmMy7EHA.2568@TK2MSFTNGP10.phx.gbl...
>> > Well, that is rather a surprise Stefan and it does seem to indicate
>> > that there may be something else operative here. I must add that
>> > you comment of W2k with no service packs installed does not
>> > sound encouraging as such a machine usually will become heavily
>> > compromised in a very short time if connected to the open network.
>> > Since the tweak of GroupPolicy is not effective you should just set
>> > it back to what it was.
>> > You could try seeing whether remote use of NTrights.exe helps
>> > http://support.microsoft.com/default.aspx?scid=kb;en-us;279664
>> > You should try this logged into the machine where the tool runs
>> > using a account that matches in name and password an admin
>> > account on the machine that has the problem.
>> > You should be able to but apparently cannot get NTrights by following
>> > the Tools linkpath from
>> > http://www.microsoft.com/windows2000/techinfo/reskit/default.asp
>> > and I also do not find a link searching microsoft.com/downloads
>> > so you may have to do some hunting to find this, as I do not find
>> > the W2k version available. However, you might find the W2k3
>> > version of use - no guarantees here of course, and you have not
>> > mentioned if the other machine available is W2k, XP, or . . .
>> >
> http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en
>> > but these tools are for use on XP or W2k3 - I have not tried these
>> > versions in W2k.
>> > --
>> > Roger Abell
>> > Microsoft MVP (Windows Security)
>> > MCSE (W2k3,W2k,Nt4) MCDBA
>> > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
>> > news:999754A3-AAA5-4BDA-8D75-FC15F1FA6A12@microsoft.com...
>> >> 99.9% sure. However, to be certain, via the network C drive share I
>> > removed
>> >> 'Everyone', added 'AuthenticatedUsers' and set the permissions to:
>> >> Adminstrators : deny full
>> >> System : deny full
>> >> AuthenticatedUsers : deny full
>> >> The sub-directories and contents were also explicitly set to deny full
>> >> for
>> >> all three.
>> >> The deny full for A-Users worked because I could no longer access the
>> >> GroupPolicy directory so I guess the same applies to Admins.
>> >> Despite this, I could still not login locally.
>> >>
>> >> If, from what you say, this fix should work, there must be something
>> >> anomolous with the system. Just to recapitulate, it's running
> W2k-Pro -
>> > no
>> >> SPs and was setup as a Workgroup PC. The only change I made was to
> deny
>> >> local login to group Users. I attempted to do a repair re-install at
>> > which
>> >> point I changed it to a Domain PC to try and login to the domain, but
> the
>> >> re-install did not complete and I had to reboot. The machine came back
> up
>> > OK
>> >> with only the local login prompt.
>> >>
>> >> The login authentication seems to be OK since an incorrect user or
>> > password
>> >> produces a normal logon failure message.
>> >>
>> >> The only thing I have observed whenever I tried to login was that the
> sam
>> > &
>> >> sam.log files in sys32/config are updated.
>> >>
>> >> If this fix cannot be made to work, would there be another way to
>> >> approach
>> >> it if I did a parallel installation - say by copying the relevent
>> >> files
>> > from
>> >> that installation? I rather get the feeling that this problem is
>> >> going
>> >> to
>> >> take some experimenting in order to locate the cause. My problem is,
>> >> I
>> > know
>> >> virtually nothing about the inner workings in order to do this. At
>> >> the
>> > end
>> >> of the day, I can always do a full re-install, tho' I'd rather avoid
> this
>> > if
>> >> I can. What I don't want to do is waste your time on what could be a
>> >> fruitless chase - so if you want to sign off on this then go ahead -
> I'll
>> >> understand. I spent several years providing international support at
> the
>> > end
>> >> of a telephone so I know what a bummer this kind of thing can be.
>> >>
>> >> StefanT
>> >>
>> >> "Roger Abell" wrote:
>> >>
>> >> > Windows 2000 and earlier did not set NTFS permissions on
>> >> > directories that were from upgrade installs, or converted to
>> >> > NTFS from FAT.
>> >> > The registry part of what you were saying is behind the scenes.
>> >> > What is important is the the system32\GroupPolicy folder is
>> >> > not readable by the account logging in so that policy will not
>> >> > be applied to it. I have never had someone not have this work
>> >> > for them when in your situation, at least as I hear your description
>> >> > of the situation. 100% success until now. So, are you sure that
>> >> > the Deny of full control for administrators was saved, and perhaps
>> >> > check that it propagated onto the contents of the folder.
>> >> > The "normal" permissions for the folder in Windows 2000 (server)
>> >> > are grants of Administrators Full ; SYSTEM Full; and Authenticated
>> >> > Users Read&Execute (and so List+Read)
>> >> >
>> >> > --
>> >> > Roger Abell
>> >> > Microsoft MVP (Windows Security)
>> >> > MCSE (W2k3,W2k,Nt4) MCDBA
>> >> > "stefanT" <stefanT@discussions.microsoft.com> wrote in message
>> >> > news:C9ADAD1D-1D45-4565-9BBE-C79F4E029C6F@microsoft.com...
>> >> > > OK. take #2
>> >> > >
>> >> > > I find I can access via the network after all. So I navigate to
>> >> > > sysroot/sys32/GroupPolicy and set Deny on full for Administrators.
>> > I've
>> >> > not
>> >> > > logged in locally yet so I give it a try. No joy. I reboot the
>> > machine
>> >> > and
>> >> > > try again - still no joy. Same logon message - 'local policy does
>> >> > > not
>> >> > permit
>> >> > > interactive logon'. Any thoughts?
>> >> > >
>> >> > > What should the permissions be on this directory? Mine show
>> >> > > Admins : allow unset ; deny unset
>> >> > > System : allow unset ; deny unset
>> >> > > Everyone : allow full ; deny unset
>> >> > >
>> >> >>snip
>> >
>> >
>>
>>
>
>



Re: Save me from my stupidity by Steven

Steven
Sat Jan 01 11:45:20 CST 2005

OK. Sounds good. Yes, it is not uncommon to overlook the fact that there may
be deny logon user rights assigned to a user. Though I often have a hard
time convincing people of such [not speaking of you]. Glad you got it sorted
out. --- Steve


"stefanT" <stefanT@discussions.microsoft.com> wrote in message
news:0ACA8CB7-2E58-4E9F-893E-7083BB708FFC@microsoft.com...
> It worked :^).
>
> I initially tried "ntrights -m \\mycomputer +r SeInteractiveLogonRight -u
> users" but this failed and then I remembered that Deny overides Allow.
>
> "ntrights -m \\mycomputer -r SeDenyInteractiveLogonRight -u users" did the
> trick.
>
> Thank you very much for your help and your patience gentlemen. Have a
> happy
> new year.
>
> StefanT
>
> "Steven L Umbach" wrote:
>
>> Ntrights is available at the link below. Of course anyone attempting to
>> use
>> it needs to know that the user right used in the command is case
>> sensitive.
>> The problem could be a lack of the logon locally user right or that a
>> group
>> the user is in [everyone, users] has in the deny logon locally user
>> ight. --- Steve
>>
>> http://www.petri.co.il/download_free_reskit_tools.htm
>>
>> [ ntrights -m \\mycomputer +r SeInteractiveLogonRight -u users ] for
>> instance to grant users logon locally user right over the network to
>> computer named my computer. Of course you would need to be logged onto
>> source computer with an account that is an administrator on target locked
>> out computer and have the user right for access this computer from the
>> network on the locked out computer.
>>
>>
>> "Roger Abell" <mvpNOSpam@asu.edu> wrote in message
>> news:u1IfmMy7EHA.2568@TK2MSFTNGP10.phx.gbl...
>> > Well, that is rather a surprise Stefan and it does seem to indicate
>> > that there may be something else operative here. I must add that
>> > you comment of W2k with no service packs installed does not
>> > sound encouraging as such a machine usually will become heavily
>> > compromised in a very short time if connected to the open network.
>> > Since the tweak of GroupPolicy is not effective you should just set
>> > it back to what it was.
>> > You could try seeing whether remote use of NTrights.exe helps
>> > http://support.microsoft.com/default.aspx?scid=kb;en-us;279664
>> > You should try this logged into the machine where the tool runs
>> > using a account that matches in name and password an admin
>> > account on the machine that has the problem.
>> > You should be able to but apparently cannot get NTrights by following
>> > the Tools linkpath from
>> > http://www.microsoft.com/windows2000/techinfo/reskit/default.asp
>> > and I also do not find a link searching microsoft.com/downloads
>> > so you may have to do some hunting to find this, as I do not find
>> > the W2k version available. However, you might find the W2k3
>> > version of use - no guarantees here of course, and you have not
>> > mentioned if the other machine available is W2k, XP, or . . .
>> > http://www.microsoft.com/downloads/details.aspx?familyid=9d467a69-57ff-4ae7-96ee-b18c4790cffd&displaylang=en
>> > but these tools are for use on XP or W2k3 - I have not tried these
>> > versions in W2k.
>> > --
>> >