Admin User Accounts - privilages lost

[Guest]

Windows XP Professional SP2 - fully patched.

When I installed XP I created two Administrator accounts and three limited
user accounts.

For some reason the administrator accounts appear to have lost the ability
to change the registry. Some programs will now not install, or come up with
"fatal errors". Adobe Acrobat keeps asking me to register even though I tick
the box telling it not to ask me again. I can, however, run regedit and make
manual changes to the registry.

The accounts show up as "Administrators" in the User Accounts application in
control panel.

I have logged in as the main system administrator and this does not have the
problem - it has all the usual administrator privilages.

I have tried changing the Accounts to Limited and back with reboots in
between and this has made no difference. I have run full virus and spyware
scans using up to date full copies of AVG and spyware doctor to no avail.

Any suggestions as to how this might be fixed?
I want to avoid creating new accounts if this can be avoided.

 

[Steven L Umbach]

Use the command net localgroup administrators to make sure it shows that
these users are indeed members of the administrators group. Also make sure
that they are not members of the guests group. Keep in mind that if those
user accounts have deny permissions defined in an access control list
[registry or file] that the deny permissions will override their allow
permissions though that would not be the case by default. It may help to use
the secedit command as shown in the link below to restore security settings
to default defined levels in case they got messed up somehow. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;313222

 

[Guest]

The affected users were only members of the Administrators group. Used the
management console to change accounts - to no avail. Tried the Secedit fix
but that did not work either. There appears to be nothing wrong with the
Administrator group per se, just the particular users. I suspect a strange
acl problem, but I don't have the knowledge or time to track that down.

Anyway, I went down the route of creating new users with Administrator
privilages and copying across the desktop items, Favourites, My Documents,
Outlook files etc. A total bore but it worked! Thanks for your help anyway.

Use the command net localgroup administrators to make sure it shows that
these users are indeed members of the administrators group. Also make sure
that they are not members of the guests group. Keep in mind that if those
user accounts have deny permissions defined in an access control list
[registry or file] that the deny permissions will override their allow
permissions though that would not be the case by default. It may help to use
the secedit command as shown in the link below to restore security settings
to default defined levels in case they got messed up somehow. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;313222

Windows XP Professional SP2 - fully patched.

When I installed XP I created two Administrator accounts and three limited
user accounts.

For some reason the administrator accounts appear to have lost the ability
to change the registry. Some programs will now not install, or come up
with
"fatal errors". Adobe Acrobat keeps asking me to register even though I
tick
the box telling it not to ask me again. I can, however, run regedit and
make
manual changes to the registry.

The accounts show up as "Administrators" in the User Accounts application
in
control panel.

I have logged in as the main system administrator and this does not have
the
problem - it has all the usual administrator privilages.

I have tried changing the Accounts to Limited and back with reboots in
between and this has made no difference. I have run full virus and
spyware
scans using up to date full copies of AVG and spyware doctor to no avail.

Any suggestions as to how this might be fixed?
I want to avoid creating new accounts if this can be avoided.

 

[Steven L Umbach]

What may help is a couple of free tools from SysInternals called regmon and
filemon. You can logon as one of the problem users and run regmon and
filemon and then look in the log for those for access denied entries which
could help you track down where permissions are lacking and then make
adjustments though usually running secedit as per KB will reset registry
permissions. --- Steve

http://www.sysinternals.com/Utilities/Regmon.html --- regmon and link to
SysInternals

The affected users were only members of the Administrators group. Used
the
management console to change accounts - to no avail. Tried the Secedit
fix
but that did not work either. There appears to be nothing wrong with the
Administrator group per se, just the particular users. I suspect a
strange
acl problem, but I don't have the knowledge or time to track that down.

Anyway, I went down the route of creating new users with Administrator
privilages and copying across the desktop items, Favourites, My
Documents,
Outlook files etc. A total bore but it worked! Thanks for your help
anyway.

Use the command net localgroup administrators to make sure it shows that
these users are indeed members of the administrators group. Also make
sure
that they are not members of the guests group. Keep in mind that if those
user accounts have deny permissions defined in an access control list
[registry or file] that the deny permissions will override their allow
permissions though that would not be the case by default. It may help to
use
the secedit command as shown in the link below to restore security
settings
to default defined levels in case they got messed up somehow. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;EN-US;313222

Windows XP Professional SP2 - fully patched.

When I installed XP I created two Administrator accounts and three
limited
user accounts.

For some reason the administrator accounts appear to have lost the
ability
to change the registry. Some programs will now not install, or come up
with
"fatal errors". Adobe Acrobat keeps asking me to register even though
I
tick
the box telling it not to ask me again. I can, however, run regedit
and
make
manual changes to the registry.

The accounts show up as "Administrators" in the User Accounts
application
in
control panel.

I have logged in as the main system administrator and this does not
have
the
problem - it has all the usual administrator privilages.

I have tried changing the Accounts to Limited and back with reboots in
between and this has made no difference. I have run full virus and
spyware
scans using up to date full copies of AVG and spyware doctor to no
avail.

Any suggestions as to how this might be fixed?
I want to avoid creating new accounts if this can be avoided.