I'm in an unusual predicament in that there is no account I can use to add local admin rights to a computer with the exception of the Administrator account - which is disabled.

On a new domain I'm setting up, I created a GPO to try make the logged in user (and others) a local admin by adding the domain group to the LOCALCOMPUTER\Administrators group. I followed this guide http://richardstk.com/2013/11/26/adding-domain-users-to-the-local-administrators-group-using-group-policy/ and used groups that have the users in them.

The GPO must've worked to some extent because it removed everyone from the Administrators group except Administrator. But because that account is locked, I can use it to log in and set the other local account or any domain accounts.

How do I unlock the Administrator account without being a local administrator? Or, how can I restore another local admin or domain account to the Administrators group?

I've tried the GUI and CMD methods without success: enter image description here


Use an NTPasswd boot disk to enable the administrator account on the machine. Then you can try to fix the permissions.

Or just fix the GPO to add everyone back.

  • yeah I was just about to resort to the UBCD with that on it. Do you have a reference for the commands to use? – Reece Aug 17 '15 at 23:51
  • @reecedodds NTPasswd gives you a nice step by step menu...no reference needed, just read each screen carefully. – Grant Aug 17 '15 at 23:52
  • Fixing the GPO was the solution. When I followed the guide I misread the instruction and "added Administrator group" with "member of" including the AD security groups. It should've been the other way around - "Add Group" should've been my security groups and "member of" being "Administrators" group. Logging into the AD user on the computer, running gpudate /force /boot and everything came good after the restart. Thanks – Reece Aug 18 '15 at 1:06

You probably misconfigured something in your GPO, and the end result was removing admin rights to users which should have kept them; anyway, have you tried disabling the offending GPO and restarting the computer? This should revert it back to its previous configuration.

You can also create another GPO and force the status of the local Administrator account to enabled; this will take precedence on any local setting on the computer, and it will enable the account allowing you to log in.

  • You were right about disabling the GPO restoring Administrators that included the local user account. – Reece Aug 18 '15 at 1:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.