Deny Interactive Login with XP Pro

[Eric Quilitzsch]

I have set the "Deny Interactive Login" policy to on for
my administrator account on XP Pro. I can still log in
under two power user accounts that I have created but I
cannot fix the problem from there. Can I get to that flag
from another route?

 

[Mike Matheny]

You didn't create an alternative administrator account? I always create a
backup administrator account in case something like this happens.

 

[Guest]

I do have another Administrator Account on this machine.
I do not maintain that account and am concerned that when
I changed this parameter I did it for administrators not
just one specific user. I am chasing down the other
administrator but also am in a time crunch and want to
have a backup plan in case he cannot get in either.

 

[Mike Matheny]

Did the policy say deny interactive logon (and if so, where was it located),
or did it say deny logon locally?

 

[Roger Abell [MVP]]

OK, this is local policy only, right ?
If you can access the machine over the network, try mapping
C$ share using admin credentials (assuming C:\) unless you
have turned off the default shares.

Assuming the NTFS settings are still at installation default,
you need to be running as an admin or as System account,
in order to modify permissions on the remapped (assuming C:\)
C:\WINDOWS\system32\GroupPolicy

Here you need to set a Deny of Full for Administrators.
Once this is set, disconnect the share, and log in with your
admin account on the problem system, then remove the Deny
and edit local policy to change the setting.

A Power User cannot do the above, locally or over the network.

Also, set the password on the other admin account to something
you know.