We recently made some group policy changes, and accidentally added our Admin group to the deny login permissions. Once this was distributed via Group Policy, we cannot login to the server to change it back. If we had on-prem console access to the box, I understand there are a few tools that we could use to reset this policy. However, as the box is in Azure, we cannot. Does anyone have any recommendations or come across a way of resolving this type of issue?
4
-
Perhaps I'm missing something... Why not just install GPMC on a member server and edit the policy from there? Wait for it to replicate, then you can logon to the DC's again.– ClaytonMay 15, 2017 at 21:36
-
I tried that, as well as editing the Registry from another machine. The permissions were all denied,– NoahMay 16, 2017 at 12:15
-
Can the domain admins login anywhere in the domain? If not, try using one of your backup operators to restore the GPO to an earlier state where it was not denying logons from domain admins.– ClaytonMay 16, 2017 at 12:57
-
Domain admins can't login anywhere to the domain. It seems that the backups were not working properly for the domain, so we can't just restore one of those.– NoahMay 16, 2017 at 17:16
Add a comment
|
1 Answer
Ultimately the answer was to download the VHD file for the domain controller, load it via Hyper-V, and login via console access. I logged in and fixed the group policy issue. Then I re-upload the VHD file (via page upload, not block) back to Azure with a new name. Using CloudXplorer, I broke the lease on the current OS drive, deleted it, and renamed the new filename to the original. Rebooted the server, and it came up and let me in once again. Its not pretty, but it did the job. if MS provides console access to Azure VMs in the future, this will be much easier.
Sad that MS took 5+ days and never presented this as an option, and still haven't gotten a solution to us, even though we are on EA Direct Support.