Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Work at a school and we've got a scenario.

We block F8 on all computers so students cannot access Safe Mode to bypass Group Policy... But students are logging into their accounts using AD, and they are turning them off half way through.

Then they are claiming that when they login next time, they have Local Administrator accounts.

Is this right, but we have blocked F8 and Startup repair, so wondering how they actually did it.

Cheers Richard

share|improve this question

closed as not a real question by MDMarra, HopelessN00b, Greg Askew, mdpc, jscott Nov 8 '12 at 4:17

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

What did you set the original local admin account to? Perhaps change it globally. You cannot break a GP, it either applies or it does not. – scape Nov 7 '12 at 20:15
You're essentially handing us a sealed black box that makes no sound when it's shaken and asking us to tell you precisely what's inside. – MDMarra Nov 7 '12 at 20:15
@scape That's not entirely true. Most GPOs just toggle registry keys. A local administrator can overwrite these keys if they choose. Granted, they will be written back at the next policy refresh. – MDMarra Nov 7 '12 at 20:16
@MDMarra This is true – scape Nov 7 '12 at 20:19
up vote 4 down vote accepted

Right, I work in a college myself and most students don't know the difference between "having local admin access" and "I can see a shortcut I couldn't before" and "I can get a command prompt up, never mind what I actually can and can't do in it". Don't try and diagnose the problem based on what a student is telling you. The most likely explanation based on what you've said so far is that either they're not getting local admin access or they're not going about it the way they claim to be doing. Simple as that. Worrying about this isn't helping you fix the actual issue, whatever that turns out to be.

Assuming the windows installation/image you use and the GPOs you use are even vaguely standard, they're not getting local admin access just because they unplugged the computer from the LAN. The issue with GPOs not applying under those circumstances is a well known one, however, but this just stops the settings in those GPOs from being applied consistently/at all.

I think the first thing you need to do is look at the logs and group memberships of their accounts as MDMarra suggests, and secondly, maybe try replicating what they're doing for yourself, then you'll understand exactly what it is they are seeing.

share|improve this answer
+1, most students don't know the difference [...] - not just students. Most users in general. If the only evidence that the students actually have admin access is that they say they do, then there's no indication they actually have admin access. – HopelessN00b Nov 7 '12 at 21:01
Well this is true, we have been told all this from a teacher of what they saw, the full line was "Getting a teacher account", which is impossible so we concluded it was a local administrator account. Do you think, that unplugging network on startup then plugging in when trying to login would bypass the startup GPOs? – x06265616e Nov 7 '12 at 21:31
Does unplugging the computer from the network stop the computer from downloading current GPO's and applying them? Yes, of course it does. The computer is unplugged! Does it undo everything that the previous GPO's did to it? No. The GPO's stay in place until otherwise told to, i.e. new GPO's or the GPO's are unapplied via Active Directory. – longneck Nov 7 '12 at 22:01
@Richard'Bean'Williams you need to see this in action for yourself. Really. I've been there and done that with these issues and helped others with it, too. Do you have wallpaper locked down by GPO for students, and not for staff? (or different wallpaper for staff?) well unplugging the computer will stop GPOs applying, and to most teachers/lecturers, 'different wallpaper to the normal student wallpaper' = 'admin / teacher account'. This can easily happen if you've referenced wallpaper on/downloaded from a network share so you can easily change it. – RobM Nov 7 '12 at 22:08
We use different wallpapers for staff and students, so just need to remind the staff to check to see what wallpaper they have! – x06265616e Nov 7 '12 at 22:18

What you are mentioning doesn't sound correct. What it sounds like is that students have found a way to bypass the group policy application by starting a login, powering down the machine before the polices are applied, and then they power the machine one without network access, and they authenticate with cached credentials, but the polices cannot be applied.

I have two suggestions for you.

The combination of blocking cached credentials, and forcing group policies to be fully applied before the user gets a desktop should eliminate any access the user gets by forcing the machine to shutdown before the group polices are finished processing.

share|improve this answer

There's obviously some way that they're getting local admin access. Are you granting it to them, or does someone that has admin access granting it to them?

Seriously, there's no way this can be answered based on the details given. The answer to this question is really "look at security logs and audit group membership."

share|improve this answer

The students are lying to you.

Are the local administrator accounts still intact as they were before? ie, proper password etc?

At a local school to us they were having difficulty with something similar, where random users seemed to be granted local admin rights... turns out someone had a password change boot CD or USB drive and was resetting the local admin account password and then logging in as the local admin and adding their own account to the local Administrators group.

We instructed the staff in how to lock out other boot devices first, and then how to globally control the membership of the "Administrators" group via group policy.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.