Denied admin ability to login to Windows 2003 remotely

Question

Problem: I have a 2003 configured with AD running in virtualbox. I was able to login as admin as normal but i could not login as any other user from my AD, logging in i would get, 'local policy does not allow interactive login' error.

So i began changing things and without much thought i did this: Group Policies -> Local Computer Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment > and added domain users group to Deny Logon Locally.

As you can expect i can no longer login as admin. I get the same, 'local policy does not allow interactive login' for the admin user.

Can anyone help me get my admin to login again, my 2003 is configured with default settings and the VM has no snapshots ?

Answer 1

You'll have to change the policy back from another computer.

If you're logged into the other computer with an account that has admin privilidges on the domain controller:

1. WinKey+R mmc OK
2. File -> Add/Remove Snap-ins
3. Select Group Policy Object, Add, Browse, Another Computer, enter the name/ip, OK, Finish, OK
4. Navigate to Windows Settings > Security Settings > Local Policies > User Rights Assignment
5. Fix groups...

If you aren't logged in with an account with rights:

1. Open Control Panel
2. Credential Manager
3. Add Windows Credentials. Be sure to use the exact name/ip that you'll use above.

Answer 2

download and install the Windows Server 2003 Remote Administration Pack [1]to a XP Workstation or RSAT [2] to a Win 7 Workstation. The start the mmc with domain admin rights. This allows you to change your GPO settings from the Client.

[1]https://www.microsoft.com/en-us/download/details.aspx?id=7045 [2]https://www.microsoft.com/de-de/download/details.aspx?id=7887