I am setting up my very first Win 2000 workstation. I'm
learning the increased control I have compared to NT WS.
All was going great -- I was deciding who can do what and
imposing some restrictions.

I was having trouble allowing all users to run Defrag and
making standard Quick Launch icons on all profiles (Still
unresolved). And then I did it...
I saw that I could restrict users from accessing the MMC
and making unauthorized changes, so I limited their access
to the MMC.

Ouch! Now I can't even access MMC snap-ins as the
Administrator! It says I'm restricted by policy -- but I
can't access Policy to change it. I've tried logging in
as Local Administrator and Network Administrator. Still
I'm denied!

I'd really appreciate any pearls of wisdom you can share!
Thanks!

Try to give your user account deny permissions to the \winnt\system32\group policy
folder. Log off and back on and try again. --- Steve

"Jim (in big mess!)" <(E-Mail Removed)> wrote in message
news:041c01c38f6c$8cb13710$(E-Mail Removed)...
> I am setting up my very first Win 2000 workstation. I'm
> learning the increased control I have compared to NT WS.
> All was going great -- I was deciding who can do what and
> imposing some restrictions.
>
> I was having trouble allowing all users to run Defrag and
> making standard Quick Launch icons on all profiles (Still
> unresolved). And then I did it...
> I saw that I could restrict users from accessing the MMC
> and making unauthorized changes, so I limited their access
> to the MMC.
>
> Ouch! Now I can't even access MMC snap-ins as the
> Administrator! It says I'm restricted by policy -- but I
> can't access Policy to change it. I've tried logging in
> as Local Administrator and Network Administrator. Still
> I'm denied!
>
> I'd really appreciate any pearls of wisdom you can share!
> Thanks!
>
>

Hi Jim. After second though, I realized that advice probably will not work.
What will work if you are in a domain, exempt yourself from a Group Policy
by using filtering where you give yourself as a user or group deny
permissions to the "apply" permision for the Group Policy under
properties/security. If you are not in a domain you still should be able to
access the Group Policy for that computer remotely on another network
computer by using mmc and selecting Group Policy but instead of local
computer select browse/computers/another computer and type in the name of
the target locked out computer. You will need to be logged onto the remote
computer with the same logon name/password as the target computers
administrator or you may be prompted for credentials. --- Steve

"Steven L Umbach" <(E-Mail Removed)> wrote in message
news:g3Hhb.731615$uu5.124346@sccrnsc04...
> Try to give your user account deny permissions to the
\winnt\system32\group policy
> folder. Log off and back on and try again. --- Steve
>
> "Jim (in big mess!)" <(E-Mail Removed)> wrote in message
> news:041c01c38f6c$8cb13710$(E-Mail Removed)...
> > I am setting up my very first Win 2000 workstation. I'm
> > learning the increased control I have compared to NT WS.
> > All was going great -- I was deciding who can do what and
> > imposing some restrictions.
> >
> > I was having trouble allowing all users to run Defrag and
> > making standard Quick Launch icons on all profiles (Still
> > unresolved). And then I did it...
> > I saw that I could restrict users from accessing the MMC
> > and making unauthorized changes, so I limited their access
> > to the MMC.
> >
> > Ouch! Now I can't even access MMC snap-ins as the
> > Administrator! It says I'm restricted by policy -- but I
> > can't access Policy to change it. I've tried logging in
> > as Local Administrator and Network Administrator. Still
> > I'm denied!
> >
> > I'd really appreciate any pearls of wisdom you can share!
> > Thanks!
> >
> >
>
>

Hi Jim,

The following Microsoft Knowledge Base Article describes a registry edit that will
temporarily allow the use of the Group Policy snap-in.

KB263166 - Administrator May Be Unable to Edit Group Policy in Windows 2000 Domain
http://support.microsoft.com/?scid=263166

--
Carrie Garth, Microsoft MVP for Windows 2000
-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- c x g

> "Jim (in big mess!)" <jnardone AT ci DOT live-oak DOT tx DOT us>
> Wrote in message news:041c01c38f6c$8cb13710$(E-Mail Removed)
> Sent: Friday, October 10, 2003 03:24 PM
>
> I am setting up my very first Win 2000 workstation. I'm
> learning the increased control I have compared to NT WS.
> All was going great -- I was deciding who can do what and
> imposing some restrictions.
>
> I was having trouble allowing all users to run Defrag and
> making standard Quick Launch icons on all profiles (Still
> unresolved). And then I did it...
> I saw that I could restrict users from accessing the MMC
> and making unauthorized changes, so I limited their access
> to the MMC.
>
> Ouch! Now I can't even access MMC snap-ins as the
> Administrator! It says I'm restricted by policy -- but I
> can't access Policy to change it. I've tried logging in
> as Local Administrator and Network Administrator. Still
> I'm denied!
>
> I'd really appreciate any pearls of wisdom you can share!
> Thanks!