2

Kind of an embarrassing question but...

One day I was playing around with GPOs to try and grant local Administrator access to a specific User group for a specific Client computer.

Somehow, I messed up the GPO. I have since deleted that GPO and I can’t find the original guide I was following.

The end result is that I now have a server running Windows Server 2012 R2, which I cannot connect to via RDP, using a domain Administrator account!

I receive the following message when attempting to connect as a domain Administrator:

To sign in remotely, you need the right to sign in through Remote Desktop Services. By default, members of the Administrators group have this right. If the group you are in doesn’t have this right, or if the right has been removed from the Administrators group, you need to be granted this right manually.

Basically, how can I “undo” the effects of that old GPO, and return the RDP access settings to their default state? I know I could just add “Administrators” to the list of allowed users in the control panel, but I want to make sure I actually reverse whatever changes I accidentally made before.

Improve this question
2
  • 1
    An important point to note: Deleting a GPO doesn't revert the settings that were configured by that GPO. You need to "unconfigure" the settings and then delete the GPO.
    – joeqwerty
    Jun 16, 2016 at 23:01
  • I know this. At the time, I thought the GPO hadn’t worked at all, so I just deleted it. Turns out it affected just this one server. And since I don’t frequently login to this server, I only just realized it now. So now I need to figure out how to reverse the effects of a GPO that doesn’t exist anymore.
    – Daniel
    Jun 16, 2016 at 23:41

3 Answers 3

Reset to default
4

Finally found the problem. Launch gpedit.msc, navigate to Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment -> Allow log on through Remote Desktop Services In my case this was empty, whereas on my working Servers it had the group Administrators. Adding the group Administrators immediately fixed my problem.

Improve this answer
3

It sounds like you were playing with Restricted Groups. If so, the group isn't restricted any more, but everyone who was in that group has been kicked out.

You need to create a new GPO and apply it. Then you can log in. After you're safely logged in, you can un-apply it and make sure the group membership is what you want it to be.

Improve this answer
8
  • I have console access to the server. I don’t need to fix the problem via GPO. How can I fix it on the machine directly?
    – Daniel
    Jun 16, 2016 at 23:40
  • Edit the membership of the Administrators group, or whichever group it was that you changed.
    – Katherine Villyard
    Jun 17, 2016 at 1:00
  • Is there any way I can see which groups have been changed from default :o
    – Daniel
    Jun 17, 2016 at 7:17
  • Unfortunately, no. :( If you have a similar server that didn't have the same policy applied, it might help you make an educated guess.
    – Katherine Villyard
    Jun 17, 2016 at 11:26
  • So... apparently you can’t directly edit local users and groups on a domain controller, which this server happens to be. Soooooo, how can I edit this local group from the console :o
    – Daniel
    Jun 17, 2016 at 14:06
-1

If someone really needs to restore a deleted GPO or roll back to a previous version of a GPO, you can do it with Advanced Group Policy Management (available as part of the Microsoft Desktop Optimization Pack (MDOP) for Software Assurance).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .