interactive logon has been disabled

[ebelingj]

our w2k server was hacked. when i boot it it will not let
me log onto it say "your interactive logon has been
disabled" this is login with the admin account..

i have tried the ms q article 313222

it doesn't work.. i can get into safe mode
if have checked the security policy for logon privileges
and they seem to be ok

help i am getting my butt kicked by this

tape restoration from tapeware does not work either

 

[Steven L Umbach]

Something does not make sense. If you can logon in safe mode, you should be
able to logon regularly with the same account I believe. Possibly the
account has been disabled in account properties? -- Steve

 

[ebelingj]

already checked that its not anything else

-----Original Message-----
Something does not make sense. If you can logon in safe mode, you should be
able to logon regularly with the same account I believe. Possibly the
account has been disabled in account properties? -- Steve




.

 

[Steven L Umbach]

If it has been hacked/compromised and acting as it does, I would get the
data off of it that I need and then reformat and reinstall and take measures
to prevent the same from happening again. You might try to use ntrights or
replace the secedit.sdb file as shown in the tip below but I doubt that will
fix the problem you describe. If this is a domain computer, you could try
moving it to a different OU with correct user rights assignments [for both
logon locally and deny logon locally] at the GPO for that OU.--- Steve

http://www.jsiinc.com/SUBG/TIP3300/rh3361.htm
http://www.jsifaq.com/subm/tip6400/rh6459.htm -- Something else to check.
http://securityadmin.info/faq.asp#harden --- From FAQ.