PC Review


Reply
Thread Tools Rate Thread

Disabled administrator account can logon in safe mode

 
 
Freaky
Guest
Posts: n/a
 
      28th Nov 2006
Hey there,

we're having a strange issue. We're using RIS to deploy WindowsXP with
SP2 integrated (no other updates!). It's just a normal WindowsXP
install, with some driver paths so it can load all the drivers and a
domain join.

The DisableAdminAccountOnDomainJoin = 1 appears to work nicely, as the
administrator account is listed with the red cross and we can also see
the 'Account Disabled' check if we open the properties (heck we can even
see those whilst logging in as local administrator in safe mode...).
Whilst in 'normal' mode we can not log on as the local administrator and
it will nicely give an error stating the account is disabled.

This really has me confused... Any suggestions?

Below is the SIF file we use for installation. Nothing peculiar if you
ask me.

;SetupMgrTag
[Data]
AutoPartition=1
MsDosInitiated="1"
UnattendedInstall="Yes"
floppyless="1"
OriSrc="\\%SERVERNAME%\RemInst\%INSTALLPATH%"
OriTyp="4"
LocalSourceOnCD=1
DisableAdminAccountOnDomainJoin = 1

[SetupData]
OsLoadOptions="/noguiboot /fastdetect"

SetupSourceDevice="\Device\LanmanRedirector\%SERVERNAME%\RemInst\%INSTALLPATH%"

[Unattended]
UnattendMode=FullUnattended
OemSkipEula=Yes
OemPreinstall=Yes
TargetPath=\WINDOWS
FileSystem=LeaveAlone
NtUpgrade=No
OverwriteOemFilesOnUpgrade=No
OemPnpDriversPath =
\Drivers\HP\NIC;\Drivers\HP\Audio;\Drivers\HP\Video;\Dri
vers\HP\AtiChipset;\Drivers\Asus\A7V5;\Drivers\Asus\Audio;\Drivers\Asus\Monitor;
\Drivers\Asus\NIC;\Drivers\Asus\Video;\Drivers\GX620\AUDIO;\Drivers\GX620\CHIPSE
T;\Drivers\GX620\NIC;\Drivers\GX620\VGA;\Drivers\HDA-Bus
DriverSigningPolicy = Ignore

[GuiUnattended]
AdminPassword=*
EncryptedAdminPassword=NO
OEMSkipRegional=1
TimeZone=110
OemSkipWelcome=1

[UserData]
ProductKey=VVVVV-WWWWW-XXXXX-YYYYY-ZZZZZ
FullName="CompanyName"
OrgName="CompanyName"
ComputerName=%MACHINENAME%

[Display]
BitsPerPel=32
Xresolution=1024
YResolution=768

[TapiLocation]
CountryCode=31
Dialing=Tone

[Identification]
JoinDomain=%MACHINEDOMAIN%
DoOldStyleDomainJoin=Yes

[Networking]
InstallDefaultComponents=Yes
ProcessPageSections=Yes

[RemoteInstall]
Repartition=Yes

[OSChooser]
Description="XP SP2 Std Install"
Help="Dit zou een standaard installatie moeten zijn."
LaunchFile="%INSTALLPATH%\%MACHINETYPE%\templates\startrom.com"
ImageType=Flat
 
Reply With Quote
 
 
 
 
John John
Guest
Posts: n/a
 
      28th Nov 2006
I may be wrong but my understanding is that even if you disable the
built-in Administrator account you will still be able to logon with the
account in Safe-Mode or in the Recovery Console.

John

Freaky wrote:

> Hey there,
>
> we're having a strange issue. We're using RIS to deploy WindowsXP with
> SP2 integrated (no other updates!). It's just a normal WindowsXP
> install, with some driver paths so it can load all the drivers and a
> domain join.
>
> The DisableAdminAccountOnDomainJoin = 1 appears to work nicely, as the
> administrator account is listed with the red cross and we can also see
> the 'Account Disabled' check if we open the properties (heck we can even
> see those whilst logging in as local administrator in safe mode...).
> Whilst in 'normal' mode we can not log on as the local administrator and
> it will nicely give an error stating the account is disabled.
>
> This really has me confused... Any suggestions?
>
> Below is the SIF file we use for installation. Nothing peculiar if you
> ask me.
>
> ;SetupMgrTag
> [Data]
> AutoPartition=1
> MsDosInitiated="1"
> UnattendedInstall="Yes"
> floppyless="1"
> OriSrc="\\%SERVERNAME%\RemInst\%INSTALLPATH%"
> OriTyp="4"
> LocalSourceOnCD=1
> DisableAdminAccountOnDomainJoin = 1
>
> [SetupData]
> OsLoadOptions="/noguiboot /fastdetect"
>
> SetupSourceDevice="\Device\LanmanRedirector\%SERVERNAME%\RemInst\%INSTALLPATH%"
>
>
> [Unattended]
> UnattendMode=FullUnattended
> OemSkipEula=Yes
> OemPreinstall=Yes
> TargetPath=\WINDOWS
> FileSystem=LeaveAlone
> NtUpgrade=No
> OverwriteOemFilesOnUpgrade=No
> OemPnpDriversPath =
> \Drivers\HP\NIC;\Drivers\HP\Audio;\Drivers\HP\Video;\Dri
> vers\HP\AtiChipset;\Drivers\Asus\A7V5;\Drivers\Asus\Audio;\Drivers\Asus\Monitor;
>
> \Drivers\Asus\NIC;\Drivers\Asus\Video;\Drivers\GX620\AUDIO;\Drivers\GX620\CHIPSE
>
> T;\Drivers\GX620\NIC;\Drivers\GX620\VGA;\Drivers\HDA-Bus
> DriverSigningPolicy = Ignore
>
> [GuiUnattended]
> AdminPassword=*
> EncryptedAdminPassword=NO
> OEMSkipRegional=1
> TimeZone=110
> OemSkipWelcome=1
>
> [UserData]
> ProductKey=VVVVV-WWWWW-XXXXX-YYYYY-ZZZZZ
> FullName="CompanyName"
> OrgName="CompanyName"
> ComputerName=%MACHINENAME%
>
> [Display]
> BitsPerPel=32
> Xresolution=1024
> YResolution=768
>
> [TapiLocation]
> CountryCode=31
> Dialing=Tone
>
> [Identification]
> JoinDomain=%MACHINEDOMAIN%
> DoOldStyleDomainJoin=Yes
>
> [Networking]
> InstallDefaultComponents=Yes
> ProcessPageSections=Yes
>
> [RemoteInstall]
> Repartition=Yes
>
> [OSChooser]
> Description="XP SP2 Std Install"
> Help="Dit zou een standaard installatie moeten zijn."
> LaunchFile="%INSTALLPATH%\%MACHINETYPE%\templates\startrom.com"
> ImageType=Flat


 
Reply With Quote
 
Freaky
Guest
Posts: n/a
 
      28th Nov 2006
Yea it appears so... Have an XP SP2 install and tested it, same issue.

I'm sure though that it was disabled on the previous RIS installs (they
were created by someone else). Those ran SP1 and if we tried logging on
as administrator in safe mode it wouldn't succeed. We could boot into
safe mode tho'.

The search goes on.

John John wrote:
> I may be wrong but my understanding is that even if you disable the
> built-in Administrator account you will still be able to logon with the
> account in Safe-Mode or in the Recovery Console.
>
> John
>
> Freaky wrote:
>
>> Hey there,
>>
>> we're having a strange issue. We're using RIS to deploy WindowsXP with
>> SP2 integrated (no other updates!). It's just a normal WindowsXP
>> install, with some driver paths so it can load all the drivers and a
>> domain join.
>>
>> The DisableAdminAccountOnDomainJoin = 1 appears to work nicely, as the
>> administrator account is listed with the red cross and we can also see
>> the 'Account Disabled' check if we open the properties (heck we can
>> even see those whilst logging in as local administrator in safe
>> mode...). Whilst in 'normal' mode we can not log on as the local
>> administrator and it will nicely give an error stating the account is
>> disabled.
>>
>> This really has me confused... Any suggestions?
>>
>> Below is the SIF file we use for installation. Nothing peculiar if you
>> ask me.
>>
>> ;SetupMgrTag
>> [Data]
>> AutoPartition=1
>> MsDosInitiated="1"
>> UnattendedInstall="Yes"
>> floppyless="1"
>> OriSrc="\\%SERVERNAME%\RemInst\%INSTALLPATH%"
>> OriTyp="4"
>> LocalSourceOnCD=1
>> DisableAdminAccountOnDomainJoin = 1
>>
>> [SetupData]
>> OsLoadOptions="/noguiboot /fastdetect"
>>
>> SetupSourceDevice="\Device\LanmanRedirector\%SERVERNAME%\RemInst\%INSTALLPATH%"
>>
>>
>> [Unattended]
>> UnattendMode=FullUnattended
>> OemSkipEula=Yes
>> OemPreinstall=Yes
>> TargetPath=\WINDOWS
>> FileSystem=LeaveAlone
>> NtUpgrade=No
>> OverwriteOemFilesOnUpgrade=No
>> OemPnpDriversPath =
>> \Drivers\HP\NIC;\Drivers\HP\Audio;\Drivers\HP\Video;\Dri
>> vers\HP\AtiChipset;\Drivers\Asus\A7V5;\Drivers\Asus\Audio;\Drivers\Asus\Monitor;
>>
>> \Drivers\Asus\NIC;\Drivers\Asus\Video;\Drivers\GX620\AUDIO;\Drivers\GX620\CHIPSE
>>
>> T;\Drivers\GX620\NIC;\Drivers\GX620\VGA;\Drivers\HDA-Bus
>> DriverSigningPolicy = Ignore
>>
>> [GuiUnattended]
>> AdminPassword=*
>> EncryptedAdminPassword=NO
>> OEMSkipRegional=1
>> TimeZone=110
>> OemSkipWelcome=1
>>
>> [UserData]
>> ProductKey=VVVVV-WWWWW-XXXXX-YYYYY-ZZZZZ
>> FullName="CompanyName"
>> OrgName="CompanyName"
>> ComputerName=%MACHINENAME%
>>
>> [Display]
>> BitsPerPel=32
>> Xresolution=1024
>> YResolution=768
>>
>> [TapiLocation]
>> CountryCode=31
>> Dialing=Tone
>>
>> [Identification]
>> JoinDomain=%MACHINEDOMAIN%
>> DoOldStyleDomainJoin=Yes
>>
>> [Networking]
>> InstallDefaultComponents=Yes
>> ProcessPageSections=Yes
>>
>> [RemoteInstall]
>> Repartition=Yes
>>
>> [OSChooser]
>> Description="XP SP2 Std Install"
>> Help="Dit zou een standaard installatie moeten zijn."
>> LaunchFile="%INSTALLPATH%\%MACHINETYPE%\templates\startrom.com"
>> ImageType=Flat

>

 
Reply With Quote
 
John John
Guest
Posts: n/a
 
      28th Nov 2006
Unless someone who knows how to really disable it can tell us how it
might be done I would say give it good, strong password protection and
forget about trying to disable it completely. You might get a service
ticket and be happy to have it enabled for special purposes. And even
if it's disabled the guys who really want to get in through the back
door know all about the Linux password disks available out there, so
make it as secure as you can and advise users of the company (firing)
policy for those who try hack it!

John

Freaky wrote:

> Yea it appears so... Have an XP SP2 install and tested it, same issue.
>
> I'm sure though that it was disabled on the previous RIS installs (they
> were created by someone else). Those ran SP1 and if we tried logging on
> as administrator in safe mode it wouldn't succeed. We could boot into
> safe mode tho'.
>
> The search goes on.
>
> John John wrote:
>
>> I may be wrong but my understanding is that even if you disable the
>> built-in Administrator account you will still be able to logon with
>> the account in Safe-Mode or in the Recovery Console.
>>
>> John
>>
>> Freaky wrote:
>>
>>> Hey there,
>>>
>>> we're having a strange issue. We're using RIS to deploy WindowsXP
>>> with SP2 integrated (no other updates!). It's just a normal WindowsXP
>>> install, with some driver paths so it can load all the drivers and a
>>> domain join.
>>>
>>> The DisableAdminAccountOnDomainJoin = 1 appears to work nicely, as
>>> the administrator account is listed with the red cross and we can
>>> also see the 'Account Disabled' check if we open the properties (heck
>>> we can even see those whilst logging in as local administrator in
>>> safe mode...). Whilst in 'normal' mode we can not log on as the local
>>> administrator and it will nicely give an error stating the account is
>>> disabled.
>>>
>>> This really has me confused... Any suggestions?
>>>
>>> Below is the SIF file we use for installation. Nothing peculiar if
>>> you ask me.
>>>
>>> ;SetupMgrTag
>>> [Data]
>>> AutoPartition=1
>>> MsDosInitiated="1"
>>> UnattendedInstall="Yes"
>>> floppyless="1"
>>> OriSrc="\\%SERVERNAME%\RemInst\%INSTALLPATH%"
>>> OriTyp="4"
>>> LocalSourceOnCD=1
>>> DisableAdminAccountOnDomainJoin = 1
>>>
>>> [SetupData]
>>> OsLoadOptions="/noguiboot /fastdetect"
>>>
>>> SetupSourceDevice="\Device\LanmanRedirector\%SERVERNAME%\RemInst\%INSTALLPATH%"
>>>
>>>
>>> [Unattended]
>>> UnattendMode=FullUnattended
>>> OemSkipEula=Yes
>>> OemPreinstall=Yes
>>> TargetPath=\WINDOWS
>>> FileSystem=LeaveAlone
>>> NtUpgrade=No
>>> OverwriteOemFilesOnUpgrade=No
>>> OemPnpDriversPath =
>>> \Drivers\HP\NIC;\Drivers\HP\Audio;\Drivers\HP\Video;\Dri
>>> vers\HP\AtiChipset;\Drivers\Asus\A7V5;\Drivers\Asus\Audio;\Drivers\Asus\Monitor;
>>>
>>> \Drivers\Asus\NIC;\Drivers\Asus\Video;\Drivers\GX620\AUDIO;\Drivers\GX620\CHIPSE
>>>
>>> T;\Drivers\GX620\NIC;\Drivers\GX620\VGA;\Drivers\HDA-Bus
>>> DriverSigningPolicy = Ignore
>>>
>>> [GuiUnattended]
>>> AdminPassword=*
>>> EncryptedAdminPassword=NO
>>> OEMSkipRegional=1
>>> TimeZone=110
>>> OemSkipWelcome=1
>>>
>>> [UserData]
>>> ProductKey=VVVVV-WWWWW-XXXXX-YYYYY-ZZZZZ
>>> FullName="CompanyName"
>>> OrgName="CompanyName"
>>> ComputerName=%MACHINENAME%
>>>
>>> [Display]
>>> BitsPerPel=32
>>> Xresolution=1024
>>> YResolution=768
>>>
>>> [TapiLocation]
>>> CountryCode=31
>>> Dialing=Tone
>>>
>>> [Identification]
>>> JoinDomain=%MACHINEDOMAIN%
>>> DoOldStyleDomainJoin=Yes
>>>
>>> [Networking]
>>> InstallDefaultComponents=Yes
>>> ProcessPageSections=Yes
>>>
>>> [RemoteInstall]
>>> Repartition=Yes
>>>
>>> [OSChooser]
>>> Description="XP SP2 Std Install"
>>> Help="Dit zou een standaard installatie moeten zijn."
>>> LaunchFile="%INSTALLPATH%\%MACHINETYPE%\templates\startrom.com"
>>> ImageType=Flat

>>
>>


 
Reply With Quote
 
Ayush
Guest
Posts: n/a
 
      28th Nov 2006
I dont think you can disable it completly. Help files says :
The Administrator account can never be deleted, disabled, or removed from the
Administrators local group, ensuring that you never lock yourself out of the
computer by deleting or disabling all the administrative accounts. This feature
sets the Administrator account apart from other members of the Administrators
local group.

--
Ayush [ Be ''?'' Happy ]
-------------
Search - www.Google.com | Wikipedia - http://en.wikipedia.org
Snip your long urls - http://snipurl.com/
-------------


Replid to [Freaky]s message :
-----------------------------------------------------------
> Yea it appears so... Have an XP SP2 install and tested it, same issue.
>
> I'm sure though that it was disabled on the previous RIS installs
> (they were created by someone else). Those ran SP1 and if we tried
> logging on as administrator in safe mode it wouldn't succeed. We
> could boot into safe mode tho'.
>
> The search goes on.
>
> John John wrote:
>> I may be wrong but my understanding is that even if you disable the
>> built-in Administrator account you will still be able to logon with
>> the account in Safe-Mode or in the Recovery Console.
>>
>> John
>>
>> Freaky wrote:
>>
>>> Hey there,
>>>
>>> we're having a strange issue. We're using RIS to deploy WindowsXP
>>> with SP2 integrated (no other updates!). It's just a normal
>>> WindowsXP install, with some driver paths so it can load all the
>>> drivers and a domain join.
>>>
>>> The DisableAdminAccountOnDomainJoin = 1 appears to work nicely, as
>>> the administrator account is listed with the red cross and we can
>>> also see the 'Account Disabled' check if we open the properties
>>> (heck we can even see those whilst logging in as local
>>> administrator in safe mode...). Whilst in 'normal' mode we can not
>>> log on as the local administrator and it will nicely give an error
>>> stating the account is disabled.
>>>
>>> This really has me confused... Any suggestions?
>>>
>>> Below is the SIF file we use for installation. Nothing peculiar if
>>> you ask me.
>>>
>>> ;SetupMgrTag
>>> [Data]
>>> AutoPartition=1
>>> MsDosInitiated="1"
>>> UnattendedInstall="Yes"
>>> floppyless="1"
>>> OriSrc="\\%SERVERNAME%\RemInst\%INSTALLPATH%"
>>> OriTyp="4"
>>> LocalSourceOnCD=1
>>> DisableAdminAccountOnDomainJoin = 1
>>>
>>> [SetupData]
>>> OsLoadOptions="/noguiboot /fastdetect"
>>>
>>> SetupSourceDevice="\Device\LanmanRedirector\%SERVERNAME%\RemInst\%INSTALLPATH%"
>>>
>>>
>>> [Unattended]
>>> UnattendMode=FullUnattended
>>> OemSkipEula=Yes
>>> OemPreinstall=Yes
>>> TargetPath=\WINDOWS
>>> FileSystem=LeaveAlone
>>> NtUpgrade=No
>>> OverwriteOemFilesOnUpgrade=No
>>> OemPnpDriversPath =
>>> \Drivers\HP\NIC;\Drivers\HP\Audio;\Drivers\HP\Video;\Dri
>>> vers\HP\AtiChipset;\Drivers\Asus\A7V5;\Drivers\Asus\Audio;\Drivers\Asus\Monitor;
>>>
>>> \Drivers\Asus\NIC;\Drivers\Asus\Video;\Drivers\GX620\AUDIO;\Drivers\GX620\CHIPSE
>>>
>>> T;\Drivers\GX620\NIC;\Drivers\GX620\VGA;\Drivers\HDA-Bus
>>> DriverSigningPolicy = Ignore
>>>
>>> [GuiUnattended]
>>> AdminPassword=*
>>> EncryptedAdminPassword=NO
>>> OEMSkipRegional=1
>>> TimeZone=110
>>> OemSkipWelcome=1
>>>
>>> [UserData]
>>> ProductKey=VVVVV-WWWWW-XXXXX-YYYYY-ZZZZZ
>>> FullName="CompanyName"
>>> OrgName="CompanyName"
>>> ComputerName=%MACHINENAME%
>>>
>>> [Display]
>>> BitsPerPel=32
>>> Xresolution=1024
>>> YResolution=768
>>>
>>> [TapiLocation]
>>> CountryCode=31
>>> Dialing=Tone
>>>
>>> [Identification]
>>> JoinDomain=%MACHINEDOMAIN%
>>> DoOldStyleDomainJoin=Yes
>>>
>>> [Networking]
>>> InstallDefaultComponents=Yes
>>> ProcessPageSections=Yes
>>>
>>> [RemoteInstall]
>>> Repartition=Yes
>>>
>>> [OSChooser]
>>> Description="XP SP2 Std Install"
>>> Help="Dit zou een standaard installatie moeten zijn."
>>> LaunchFile="%INSTALLPATH%\%MACHINETYPE%\templates\startrom.com"
>>> ImageType=Flat



 
Reply With Quote
 
John John
Guest
Posts: n/a
 
      28th Nov 2006
It wouldn't be out of the ordinary for a Domain Administrator to have
precedence over these matters, but your post adds weight to the notion
that it can't be disabled completely.

John

Ayush wrote:

> I dont think you can disable it completly. Help files says :
> The Administrator account can never be deleted, disabled, or removed from the
> Administrators local group, ensuring that you never lock yourself out of the
> computer by deleting or disabling all the administrative accounts. This feature
> sets the Administrator account apart from other members of the Administrators
> local group.
>


 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
ONLY ACCESS THE ADMINISTRATOR ACCOUNT IN SAFE MODE HIKER7s Microsoft Dot NET 0 20th May 2009 03:36 AM
ONLY ACCESS THE ADMINISTRATOR ACCOUNT IN SAFE MODE HIKER7s Microsoft Dot NET 0 20th May 2009 03:36 AM
Administrator - Safe Mode Logon ctowers Windows XP Basics 2 14th Apr 2007 01:04 AM
can't logon as administrator in safe mode w/ xp home =?Utf-8?B?SmlsbA==?= Windows XP General 1 14th Mar 2005 09:21 AM
administrator logon added when going into safe mode Leonard F Kiesling Windows XP New Users 1 2nd Jul 2004 01:48 AM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 08:23 PM.