Lost all local admin rights on domain joined computer

Question

I'm in an unusual predicament in that there is no account I can use to add local admin rights to a computer with the exception of the Administrator account - which is disabled.

On a new domain I'm setting up, I created a GPO to try make the logged in user (and others) a local admin by adding the domain group to the LOCALCOMPUTER\Administrators group. I followed this guide http://richardstk.com/2013/11/26/adding-domain-users-to-the-local-administrators-group-using-group-policy/ and used groups that have the users in them.

The GPO must've worked to some extent because it removed everyone from the Administrators group except Administrator. But because that account is locked, I can use it to log in and set the other local account or any domain accounts.

How do I unlock the Administrator account without being a local administrator? Or, how can I restore another local admin or domain account to the Administrators group?

I've tried the GUI and CMD methods without success:

Answer 1

Use an NTPasswd boot disk to enable the administrator account on the machine. Then you can try to fix the permissions.

Or just fix the GPO to add everyone back.

Answer 2

You probably misconfigured something in your GPO, and the end result was removing admin rights to users which should have kept them; anyway, have you tried disabling the offending GPO and restarting the computer? This should revert it back to its previous configuration.

You can also create another GPO and force the status of the local Administrator account to enabled; this will take precedence on any local setting on the computer, and it will enable the account allowing you to log in.