Administrator Denied MMC Access

[Jim \(in big mess!\)]

I am setting up my very first Win 2000 workstation. I'm
learning the increased control I have compared to NT WS.
All was going great -- I was deciding who can do what and
imposing some restrictions.

I was having trouble allowing all users to run Defrag and
making standard Quick Launch icons on all profiles (Still
unresolved). And then I did it...
I saw that I could restrict users from accessing the MMC
and making unauthorized changes, so I limited their access
to the MMC.

Ouch! Now I can't even access MMC snap-ins as the
Administrator! It says I'm restricted by policy -- but I
can't access Policy to change it. I've tried logging in
as Local Administrator and Network Administrator. Still
I'm denied!

I'd really appreciate any pearls of wisdom you can share!
Thanks!

 

[Steven L Umbach]

Try to give your user account deny permissions to the \winnt\system32\group policy
folder. Log off and back on and try again. --- Steve

 

[Steven L Umbach]

Hi Jim. After second though, I realized that advice probably will not work.
What will work if you are in a domain, exempt yourself from a Group Policy
by using filtering where you give yourself as a user or group deny
permissions to the "apply" permision for the Group Policy under
properties/security. If you are not in a domain you still should be able to
access the Group Policy for that computer remotely on another network
computer by using mmc and selecting Group Policy but instead of local
computer select browse/computers/another computer and type in the name of
the target locked out computer. You will need to be logged onto the remote
computer with the same logon name/password as the target computers
administrator or you may be prompted for credentials. --- Steve

 

[Carrie Garth \(MVP\)]

Hi Jim,

The following Microsoft Knowledge Base Article describes a registry edit that will
temporarily allow the use of the Group Policy snap-in.

KB263166 - Administrator May Be Unable to Edit Group Policy in Windows 2000 Domain
http://support.microsoft.com/?scid=263166