3

My staff accidentally applied a security database to one of my server. Instead of Analyze the Computer, he had accidentally clicked on Configure this Computer using the Security Configuration and Analysis snap-in in MMC.

For now, I'd like to revert back his changes. I have manually reverted back the Account Policies, Local Policies and Event Log settings based on another similar server; let's call it Server A.

What's bothering me now is the System Services. I found that the permission of certain groups (mainly default system user groups) in each services has been removed. I would like to restore them back.

I have tried changing it manually in MMC, but the Add option is grayed out. I've also tried using the secedit command to export out the SERVICES on Server A but I can't. When I try to manually copy the secedit.sdb on Server A, i get an error saying that it is used by services.exe. I'm worry that if I stop that services.exe process, Server A may go haywire.

Any idea I can go about doing this? Thanks.

1
  • Guys, I found a way. What I can do is use SubInACL to 'output' the permissions on Server A into file and then subsequently 'play' it on the server that needed to be restored; again with SubInACL. I've tried that on a Windows XP VM and it seems to be working. I made some light changes on the services and then restore it with a backup. Any comments?
    – Ndy
    Oct 22, 2012 at 8:49

1 Answer 1

0

It sounds like he used the security configuration wizard, which has rollback option. Did he use a different tool, or did you perhaps just not notice that?

wizard screen shot

2
  • Hi @Craig620. He was suppose to analyze the computer with a security database using the Security Configuration and Analysis snap-in in Microsoft Management Console. However, he had accidentally clicked on the "Configure this Computer" option. Also, since I have manually reverted back some changes, would it still be applicable and effective to use the Security Configuration Wizard to rollback to the last applied security policy?
    – Ndy
    Oct 22, 2012 at 20:02
  • It's been a looong time since I've used this tool, back in the early 2003 days. I just fired it up to see how much it changed, and the first screen looked like it had your fix. I think this wizard just tries to dumb down the full MMC and would probably work for you.
    – Clayton
    Oct 23, 2012 at 13:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .