Group Policy Locked Out

[Guest]

Hello:

Somehow, while trying to modify a group policy on a workstation, I set the
policy to also lock out the administrator. One of the policies enforced was
to restrict running explorer. Since I can no longer run Explorer, I can no
longer access C:\windows\system32\group policy folder. Is there any way
around this or am I going to have to reinstall?

 

[Doug Knox MS-MVP]

Group Policies on a stand alone computer apply to all users.

1) Use System Restore to restore back to a point before you made the change.

2) If you haven't locked out Regedit, go to

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun

Delete the value in the right pane that references Explorer.exe.

3) In Regedit, go to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer

Locate the DisallowRun value in the right pane and change it to 0 (zero)

 

[Guest]

Doug:

Thanks for the help and sorry about the slow response. (The customer is some
distance away and I can't get there on a regular basis. Anywaym, what you
suggested did not work. The guy that set up the machine disabled the system
restore (I don't know why). When I tried to edit the registry, the keys you
referenced do not exist. Could it be because the computer also connects to a
domain? If so, do you know of a way to just delete the entire policy from the
machine so I can get back into it?

Regards,

Rob

 

[Guest]

Can anyone help with this? I'm out of ideas. I can get into the registry, but
i'm afraid to just shash and burn and would appreciated some guidance as to
which registry keys I can safely delete to disable group policies on this
computer.

Thanks,

Rob Power

 

[Doug Knox MS-MVP]

Hi Rob,

Sorry, I've been out of town. If the system in question is on a LAN, you can always log on to another computer, with an Administrator level account that has access to the file system of the affected machine. If necessary, use the hidden Administrative Shares (\\machinename\C$) to access the C: drive. You should then be able to access the group policy folder.

Another alternative is Bart's PE. This utility creates a bootable "mini" XP, that will allow to run Explorer and access the file system, to do whatever you need there.

I don't know what effect putting local policies in place would have, if there are domain policies already in place. My thought would be that the domain policy would override local policy, but this may not be true in all cases.

 

[Doug Knox MS-MVP]

Sorry, forgot the link to Bart's PE

http://www.nu2.nu/pebuilder/