HELP!!! accidentally put the "administrators" group in the "Deny" settings

[Yssa]

HELP! In Group Policy I accidentally put
the "administrators" group in the "Deny" settings.
I was resolving a GP issue regarding deleted user names.
In editing the group policy I added the "Administrators"
group to all the security entries, specifically all
the "Deny" settings. The result is I can no longer log in
to any of my servers since they only have administrator
accounts on them and the'yre all denied logon access.

PLEASE DON'T NOT ANSWER ME BECAUSE I DID SOMETHING REALLY
STUPID!

Once you're done laughing at me and my sleepiness, do you
know a workaround to access the GP on a file level? I've
gotten in to the file system with the boot disk on the
command line and renamed all the files in
c:\WINNT\Security\Policies

Edit is not part of the boot disk tools so i renamed the
c:\winnt\sysvol\sysvol\my
domainname\machine\microsoft\windows nt\secedit\{xxxxxxxx}
\gpttmpl.inf to
c:\winnt\sysvol\sysvol\my domain
name\machine\microsoft\windows nt\secedit\{xxxxxxxx}
\gpttmpl.inf.old

and renamed the gpttmpl.inf in the root.

Not working.

I'm wondering if I'm editing the correct files or if I
have to get in to the registry as well.

I'm desperate to find any way around this problem short
of re-installing the OS, in particular on my AD DC.


Do you know where to add edit.com to the boot disks to
add it to the disk tools? Kind of stupid that they pulled
it from the 2000 boot disks. I tried adding it to Disk4,
then running it from the disk but it won't accept the
command. I was told to edit the gpttmpl.inf and remove
the administrators group from the deny list, but at the
moment I can only delete or rename.

If anyone can give me decent instructions on where and
how to edit this problem on the file level I'd be in
their debt.

Thanks in advance

 

[B-rad]

Your in luck, check out Q article 294257. Remember, just
like on NTFS permissions, you can remove your self and
get access denied, but you are still the "owner" and can
always chane the DACL/ACL of that file. AD is nothing
but a big "file" and you can reset the perms on that
particualr GPO to remove the admin group. I imagine you
aren't the first to ever do this and you probably won't
be the last.

B-rad

 

[B-rad]

BTW you will not be able to edit NTFS perms via boot
disks.

 

[yssa]

Is there any way to delete the policy on the file level
and let Windows go back to a default template or no
template? If I can't edit can I delete the offending
file to at least get access back to the domain?

 

[mm]

This should not be a big deal, i did this myself on a late
night change see the following:See KB article 329887,
313222, 257346 or To restore default security settings on
DC: i ran the following commands:Secedit /configure /cfg
C:\winnt\repair\secsetup.inf /db secsetup.sdb

Secedit /configure /cfg C:\winnt\repair\secdc.inf /db
secdc.sdb

exit
hope this helps............