Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My staff accidentally applied a security database to one of my server. Instead of Analyze the Computer, he had accidentally clicked on Configure this Computer using the Security Configuration and Analysis snap-in in MMC.

For now, I'd like to revert back his changes. I have manually reverted back the Account Policies, Local Policies and Event Log settings based on another similar server; let's call it Server A.

What's bothering me now is the System Services. I found that the permission of certain groups (mainly default system user groups) in each services has been removed. I would like to restore them back.

I have tried changing it manually in MMC, but the Add option is grayed out. I've also tried using the secedit command to export out the SERVICES on Server A but I can't. When I try to manually copy the secedit.sdb on Server A, i get an error saying that it is used by services.exe. I'm worry that if I stop that services.exe process, Server A may go haywire.

Any idea I can go about doing this? Thanks.

share|improve this question
    
Guys, I found a way. What I can do is use SubInACL to 'output' the permissions on Server A into file and then subsequently 'play' it on the server that needed to be restored; again with SubInACL. I've tried that on a Windows XP VM and it seems to be working. I made some light changes on the services and then restore it with a backup. Any comments? –  Ndy Oct 22 '12 at 8:49

1 Answer 1

It sounds like he used the security configuration wizard, which has rollback option. Did he use a different tool, or did you perhaps just not notice that?

wizard screen shot

share|improve this answer
    
Hi @Craig620. He was suppose to analyze the computer with a security database using the Security Configuration and Analysis snap-in in Microsoft Management Console. However, he had accidentally clicked on the "Configure this Computer" option. Also, since I have manually reverted back some changes, would it still be applicable and effective to use the Security Configuration Wizard to rollback to the last applied security policy? –  Ndy Oct 22 '12 at 20:02
    
It's been a looong time since I've used this tool, back in the early 2003 days. I just fired it up to see how much it changed, and the first screen looked like it had your fix. I think this wizard just tries to dumb down the full MMC and would probably work for you. –  Craig620 Oct 23 '12 at 13:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.