I messed up my Group Policy Settings in WIN2K! Need to know how to reset!

**buddhafest** · December 29th, 2003, 09:49 PM

Hi, ok i was changing some group policies in windows 2000
using gpedit.msc

but the thing is I made a big mistake and now I can't log into windows with my administrator account.
It says that it the account cannot log in with interactivity.

SO i log in with my power user account but I can't access the user settings because I need an admin account.

I tried editing the GP with my power user account but I don't have the rights to view them.!!

I'm fREAKING OUT!

how do i set it back to all default?!?!

**John Prophet** · December 29th, 2003, 10:24 PM

possibly related.... http://support.microsoft.com/?kbid=226243

at least its a bump, lol

**Beemer** · December 29th, 2003, 10:24 PM

You're hooped with WinY2K. There isn't any reliable way of restoring an old registry unless you had a exported registy backup.

There are third party programs that will create the backup and restore same but you have to have hind site and install the programs just incase you need to restore your machine to a previous state.

Someone else may have a solution. Hang in there!

Cheers!

**Siliconjunkie** · December 29th, 2003, 10:28 PM

Try this:

Log in as a power user, then go find gpedit.msc, right click it and select "run as" and use the administrator account. Or you can try the same thing with the mmc executable.

May get you in there well enough to fix it. If it does, make another account with admin rights.

**buddhafest** · December 29th, 2003, 10:28 PM

Ok so far what i found is that there is this file called

recreateDefPol.vbx

but the thing is ia can't find it anywhere.. i googled it and i just get info about how the file works but nothing bout downloading.. and

the MS support site doesnt have it either even though one site says I can get it from there..

can anyone helpe me look for it?? THIS IS nerve racking.. If all else fails i might be forced to format and do a clean install again.. but i dont want ot do that

**buddhafest** · December 29th, 2003, 10:30 PM

to silicon:

I can't make another admin account,

I log in as my power user, but when i try to make another admin it asks for the admin password , which for some reason doesn't work

and I tried running gpedit.msc but Im denied access from viewing the policies because i dont have the rights..

**Siliconjunkie** · December 29th, 2003, 10:31 PM

see the part above about using "run as" to use the administrator account.

As the power user, open a command prompt and run this:

runas /user:administrator mmc.exe

Then add/remove snapin from the file menu, add the Group Policy snapin. Undo what you did.

**eagle1** · December 29th, 2003, 10:32 PM

Try to log in as a power user (your account).
You should be able to create an account with admin privileges or better yet, go to the control panel, users, advanced and select properties over your username and add yourself to the administrator group.

I think now you should be able to run it. Also, did you tried what Siliconjunkie said?

**buddhafest** · December 29th, 2003, 10:42 PM

no can do fellas, I can't change my power user setting into an admin setting because I don't have access into the User Settings , it always asks for the admin password and the password never works

and I just tried the runas

i get this error

RUNAS:ERROR: unable to run - mmc.exe
1285: logon failure: the user has no been granted the requested logon type at this computer

**Siliconjunkie** · December 29th, 2003, 10:49 PM

hmmmm, I am thinking you may be stuck.

The big problem is that beyond this, you will basically have to hack the box to get it working and I am not even sure that you can since we are trying to go around the whole idea of security groups. The best answer may be to reinstall.

Acutally I am surprized that you were able to lock out the admin account.

Some other things to try:

#1 Start the telnet service, disable ntlm auth, telnet to localhost and login as admin? May not work because the mmc is a gui type app. There may be a command line way to change this. I will have to do some looking.

#2 Get another w2k/xp machine and use the MMC to connect to this one and modify it. (This is pretty likely to work if you have access to another box with 2k or XP on it)

**buddhafest** · December 29th, 2003, 10:55 PM

damn, well it does look to me like im stuck...

the closesest thing i found was how do change sum settings
on heree
http://support.microsoft.com/?id=226243
and
http://support.microsoft.com/?id=267553

but that wont work for me because the file im trying to edit doesnt seem to want to be found...

or in another thread it was said i should call
PS. Microsoft also has a utility "Recreatedefpol" that will also perform
this action. If you want to obtain this utility, please call
1-800-936-4900 and ask for a Direcotry Services Engineer.

now the tricky thing is... should i call?!?!

**buddhafest** · December 29th, 2003, 10:58 PM

Question

If i reinstall would i have to do a clean install for it to fix it??

or could i just install over this installation?? because IM hoping that i can keep whatever i already got on the drive??

id really prefer not to format

**Siliconjunkie** · December 29th, 2003, 11:03 PM

Don't know if it would take a clean install. The best bet would be to do a repair and see what happens.

I assume you don't have access to another machine?

**PresterJohn** · December 29th, 2003, 11:08 PM

once you revoke the admin acct from the policy rights, you're pretty much cooked unless you explicitly specified a user account with the necessary privileges.

you will need to do a clean install. delete the partition and start again. a repair is unlikely to work though you're welcome to try.

ps. be very careful when you fiddle with policies.

**buddhafest** · December 29th, 2003, 11:11 PM

u assumed correct, so i think im gonna have to do the repair method and see what happens and possibly reinstall.. unless sumhow i find that damn file!

**buddhafest** · December 29th, 2003, 11:13 PM

Damn, Prester you just made my hopes go down the drain ehhe

guess i'll try and see..

yes they need to be handled with care indeed... at least now i know!

**Siliconjunkie** · December 29th, 2003, 11:17 PM

AND, create a second admin account. That would have saved your bacon.

**eagle1** · December 29th, 2003, 11:59 PM

Now I have a question!

If he would have had a CD that rewrites the Admin password, would this have worked? I mean, is it the password Or did he just deleted the whole admin account?

**Siliconjunkie** · December 30th, 2003, 12:01 AM

He just took away its ability to log on interactively. Actually, I am shocked that you can even do this. MS is pretty good about making the admin account bulletproof.

Not sure about re-writing the GP file. In theory it should work, but may break alot of things.