Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Domain Controller which had installed RSA SecurID software
Few months ago we switched from RSA SecurID to Gemalto smart cards. This DC was the last machine with RSA software installed
Yesterday I uninstalled "RSA Authentication Agent for Windows" (through Add/Remove Programs). After restart RSA login window disappeared, but now no one can log on to this machine - even domain administrator (which was always logging in using only password). Everytime we have error message "unable to logon because of account restriction".
The same error users receive when they want o to login to their machines. We have another DC which is working without any problem, so we switched users to it.

Now I want to access this machine and fix it but don't know how

  • No one can login to this machine, even in safe mode
  • All sharings are working correctly
  • I (domain administrator) can connect from another machine to Registry (HKLM), Event Log, Group Policy (but not Local Policy)
  • psexec is connecting without any problem but I cannot see i.e. Local Policy without GUI.

Can somone help me to find the reason of this error? Someting that I can do from command line (using psexec)?

share|improve this question
How about "Directory Services Restore Mode"? Also, this might help via psexec: – Grizly Aug 26 '10 at 5:48
"Directory Services Restore Mode" - same error – SeeR Aug 26 '10 at 9:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.