First, shut down all domain controllers. Doing so will avoid bizarre replication problems.
The first step is to remove the bad Group Policy setting. Privilege assignments are stored in the GptTmpl.inf
file in MACHINE\Microsoft\Windows NT\SecEdit
under each policy folder. You'll know you have the right policy when that .inf
file contains a line for SeDenyNetworkLogonRight
, SeDenyInteractiveLogonRight
, et cetera. Delete all the SeDeny...Right
lines from it.
Windows won't apply the new settings unless it sees that the GPO has changed, which it determines by consulting the versionNumber
attribute on an Active Directory object. Let's not try to edit AD offline. Instead, we'll remove the bad settings from the Registry manually.
Mount the domain controller's \Windows\System32\config\SECURITY
hive into another Windows system's Registry with reg load
. Open the Registry Editor and navigate to Policy\Accounts
under the mounted hive. (You may need to be running regedit
as SYSTEM for that to work. PsExec can do that.) Each subkey of that corresponds to a user or group, and the ActSysAc
subkey of each of those holds the "rights." (The "privileges" are all in the Privilgs
subkey.) Find the one with an ActSysAc
value of C0 03 00 00
, which corresponds to the four rights you denied. Delete ActSysAc
or change its value to 00 00 00 00
. Close the Registry Editor and unmount the hive with reg unload
.
Boot up the domain controller you modified. You should be able to log in now. Use the Group Policy Management Console to make any edit (no matter how trivial) to the relevant GPO's Local Policies. That will increment the GPO's version number.
Boot up the other domain controllers and let the changes replicate.