4

A GPO was created and linked to top level that denies login to domain admins. No other accounts are able to log into domain controllers.

Is there a way to change this policy or somehow recover?

Right now I am faced with a large domain that is basically unmanageable since I have no way to log into DCs. DCs are Windows 2008r2 and clients are Windows 7. I can still log in to client machines. I do have puppet on the DCs and access to the puppet master.

  • You can boot into domain recovery mode. – mzhaase Jan 25 '17 at 13:22
2

Maybe you can use the GPMC, (Group Policy Management Console) opened with the domain admin rights.

Or with powershell, you can use these commands always with a console opened with domain admin rights:

Hopefully, your GPO has blocked the interactive sessions and could use these two solutions.

good luck

2

You don't have to log in to a domain controller to manage group policy. You can install the Remote Server Administration Tools on a Windows 7 PC. These are the same tools that are installed on a Windows server when you enable a feature.

https://www.microsoft.com/en-us/download/details.aspx?id=7887

Make sure you read the install instructions because just double-clicking the file will not install the tools.

2

You need to disable the problem GPO. You can do it with an LDAP client. This can be done even if you cannot login as domain admin on a domain computer:

  1. Run LDAP client (I suggest ADSI Edit). Connect to your DC and bind as Domain Admin (your policy can't block an LDAP bind). You can run ADSI Edit as any user, even from a computer outside of the domain, but when you select the connection settings in the dialogue under the "Advanced..." button you must provide domain administrator credentials. [More read about using ADSI Edit here.]

  2. Find your problem GPO ID: Browse with LDAP CN=Policies,CN=System in domain root and search for the Policy ID by displayName attribute (not an easy task when you have many policies).

  3. Once you find the policy in CN=Policies,CN=System set its flag attribute to 3 - which means GPO disabled.

  4. Wait for group policy to refresh (or reboot).

  • How do I do LDAP bind? The other solutions are not working as we seem to have policies preventing the gpmc on client machines and the powershell gpo module isn't functioning – CW33 Jan 25 '17 at 16:43
  • @CW33 You can run ADSIedit from any user, even from a computer outside of the domain, but when you select the connection settings in the dialogue under the "Advanced..." button must be set domain administrator credentials. More read about ADSIedit using here. – Slipeer Jan 26 '17 at 6:03
0

Unfortunately we were not able to make any of these things work in our situation. Other policies prevented some of it and the binding as domain credentials did not work for us either. Our solution was to use puppet, which runs as a service account to execute a secedit command and override the poorly set GPO. Thanks though for everyones help.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.