user cannot log in unless local admin member

[Joseph O'Brien]

After running a registry repair script to fix a problem with missing
icons in a specific user account, I'm running into another problem
with logging in.

The fix I applied involved running subinacl.
http://winonline.blogspot.com/2005/11/reset-entire-registry-permissions-to.html
(thanks so much for posting that, Ramesh!).

Now, this user cannot log on unless he is a member of the local admin
group. If he is only a member of the local user group explorer does
not load when he logs on. I can hit CTRL-ALT-DEL to bring up the task
manager, and there are several services running, but explorer will not
load.

Once I join his domain account to local admin, though, he is able to
log on just fine.

Since local admin rights got me into this whole mess in the first
place, I would really like to resolve this. I feel like this is
probably the last step before this computer is fixed.

I still suspect registry permission problems, but I'm not sure where
to go from here.

Thanks again for your help.
Joseph

 

[Ramesh, MS-MVP]

Hi Joseph,

Sorry to hear about the problem. Here is something that's worth a shot:

How to reset security settings back to the defaults:
http://support.microsoft.com/kb/313222

Note After security settings are applied, you cannot undo the changes without restoring from a backup. If you are uncertain about resetting your security settings back to the default security settings, you must make a complete backup that includes the "System State" (the registry files). Items that are reset include NTFS file system files and folders, the registry, policies, services, privilege rights, and group membership.

IMO, in addition to the System State backup, taking an image backup prior to applying the above fix is a good idea.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com


After running a registry repair script to fix a problem with missing
icons in a specific user account, I'm running into another problem
with logging in.

The fix I applied involved running subinacl.
http://winonline.blogspot.com/2005/11/reset-entire-registry-permissions-to.html
(thanks so much for posting that, Ramesh!).

Now, this user cannot log on unless he is a member of the local admin
group. If he is only a member of the local user group explorer does
not load when he logs on. I can hit CTRL-ALT-DEL to bring up the task
manager, and there are several services running, but explorer will not
load.

Once I join his domain account to local admin, though, he is able to
log on just fine.

Since local admin rights got me into this whole mess in the first
place, I would really like to resolve this. I feel like this is
probably the last step before this computer is fixed.

I still suspect registry permission problems, but I'm not sure where
to go from here.

Thanks again for your help.
Joseph

 

[Joseph O'Brien]

After running a registry repair script to fix a problem with missing
icons in a specific user account, I'm running into another problem
with logging in.

The fix I applied involved running subinacl.http://winonline.blogspot.com/2005/11/reset-entire-registry-permissio...
(thanks so much for posting that, Ramesh!).

Now, this user cannot log on unless he is a member of the local admin
group. If he is only a member of the local user group explorer does
not load when he logs on. I can hit CTRL-ALT-DEL to bring up the task
manager, and there are several services running, but explorer will not
load.

Once I join his domain account to local admin, though, he is able to
log on just fine.

Since local admin rights got me into this whole mess in the first
place, I would really like to resolve this. I feel like this is
probably the last step before this computer is fixed.

I still suspect registry permission problems, but I'm not sure where
to go from here.

Thanks again for your help.
Joseph

Hi Joseph,

Sorry to hear about the problem. Here is something that's worth a shot:

How to reset security settings back to the defaults:http://support.microsoft.com/kb/313222

Note After security settings are applied, you cannot undo the changes without restoring from a backup. If you are uncertain about resetting your security settings back to the default security settings, you must make a complete backup that includes the "System State" (the registry files). Items that are reset include NTFS file system files and folders, the registry, policies, services, privilege rights, and group membership.

IMO, in addition to the System State backup, taking an image backup priorto applying the above fix is a good idea.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshootinghttp://www.winhelponline.com

Ramesh,

Thanks for this advice. I have not run the secedit /config /cfg...
command yet, because I have a few questions.

1) The warning on Microsoft's site sounds ominous. However, I noticed
that running this command is frequently recommended, typically without
any warning at all. I understand that anything can go wrong, but what
are the chances that running this command will break the system beyond
repair?

2) I wish I could run some kind of backup, but NTBackup fails due to a
Volume Shadow Copy error. Norton Ghost fails for the same reason.

I'm also having trouble installing software. Group Policy has not
updated due to an error, and if I run gpreport, I get an error about
the class not being loaded. This system is a mess!

Anyway, thanks again for your help.
Joseph

 

[Ramesh, MS-MVP]

Joseph,

The suggested procedure simply resets the registry and file system permissions to defaults. You may lose any custom permissions if set earlier. I'd perform a image backup first, just in case something happens. Try one of these utilities.

Drive Image Backup Software for Windows - Image for Windows:
http://www.terabyteunlimited.com/imagew.html

Hard disk drive cloning and image backup software: computer files and disk copy:
http://www.acronis.com/homecomputing/products/trueimage/

Note that none of the above software are freeware.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com

After running a registry repair script to fix a problem with missing
icons in a specific user account, I'm running into another problem
with logging in.

The fix I applied involved running subinacl.http://winonline.blogspot.com/2005/11/reset-entire-registry-permissio...
(thanks so much for posting that, Ramesh!).

Now, this user cannot log on unless he is a member of the local admin
group. If he is only a member of the local user group explorer does
not load when he logs on. I can hit CTRL-ALT-DEL to bring up the task
manager, and there are several services running, but explorer will not
load.

Once I join his domain account to local admin, though, he is able to
log on just fine.

Since local admin rights got me into this whole mess in the first
place, I would really like to resolve this. I feel like this is
probably the last step before this computer is fixed.

I still suspect registry permission problems, but I'm not sure where
to go from here.

Thanks again for your help.
Joseph

Hi Joseph,

Sorry to hear about the problem. Here is something that's worth a shot:

How to reset security settings back to the defaults:http://support.microsoft.com/kb/313222

Note After security settings are applied, you cannot undo the changes without restoring from a backup. If you are uncertain about resetting your security settings back to the default security settings, you must make a complete backup that includes the "System State" (the registry files). Items that are reset include NTFS file system files and folders, the registry, policies, services, privilege rights, and group membership.

IMO, in addition to the System State backup, taking an image backup prior to applying the above fix is a good idea.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshootinghttp://www.winhelponline.com

Ramesh,

Thanks for this advice. I have not run the secedit /config /cfg...
command yet, because I have a few questions.

1) The warning on Microsoft's site sounds ominous. However, I noticed
that running this command is frequently recommended, typically without
any warning at all. I understand that anything can go wrong, but what
are the chances that running this command will break the system beyond
repair?

2) I wish I could run some kind of backup, but NTBackup fails due to a
Volume Shadow Copy error. Norton Ghost fails for the same reason.

I'm also having trouble installing software. Group Policy has not
updated due to an error, and if I run gpreport, I get an error about
the class not being loaded. This system is a mess!

Anyway, thanks again for your help.
Joseph

 

[Joseph O'Brien]

Ramesh,

I still couldn't get a proper backup with these tools, but I got close
enough. After running the secedit command, everything appeared to be
normal again.

Thank you again for your assistance!

Joseph

Joseph,

The suggested procedure simply resets the registry and file system permissions to defaults. You may lose any custom permissions if set earlier. I'd perform a image backup first, just in case something happens. Try one of these utilities.

Drive Image Backup Software for Windows - Image for Windows:http://www.terabyteunlimited.com/imagew.html

Hard disk drive cloning and image backup software: computer files and disk copy:http://www.acronis.com/homecomputing/products/trueimage/

Note that none of the above software are freeware.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshootinghttp://www.winhelponline.com

"Joseph O'Brien" <[email protected]> wrote in messagenews:[email protected]...

After running a registry repair script to fix a problem with missing
icons in a specific user account, I'm running into another problem
with logging in.

The fix I applied involved running subinacl.http://winonline.blogspot.com/2005/11/reset-entire-registry-permissio...
(thanks so much for posting that, Ramesh!).

Now, this user cannot log on unless he is a member of the local admin
group. If he is only a member of the local user group explorer does
not load when he logs on. I can hit CTRL-ALT-DEL to bring up the task
manager, and there are several services running, but explorer will not
load.

Once I join his domain account to local admin, though, he is able to
log on just fine.

Since local admin rights got me into this whole mess in the first
place, I would really like to resolve this. I feel like this is
probably the last step before this computer is fixed.

I still suspect registry permission problems, but I'm not sure where
to go from here.

Thanks again for your help.
Joseph

Hi Joseph,

Sorry to hear about the problem. Here is something that's worth a shot:

How to reset security settings back to the defaults:http://support.microsoft.com/kb/313222

Note After security settings are applied, you cannot undo the changes without restoring from a backup. If you are uncertain about resetting your security settings back to the default security settings, you must make a complete backup that includes the "System State" (the registry files). Items that are reset include NTFS file system files and folders, the registry, policies, services, privilege rights, and group membership.

IMO, in addition to the System State backup, taking an image backup prior to applying the above fix is a good idea.
Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshootinghttp://www.winhelponline.com

Ramesh,

Thanks for this advice. I have not run the secedit /config /cfg...
command yet, because I have a few questions.

1) The warning on Microsoft's site sounds ominous. However, I noticed
that running this command is frequently recommended, typically without
any warning at all. I understand that anything can go wrong, but what
are the chances that running this command will break the system beyond
repair?

2) I wish I could run some kind of backup, but NTBackup fails due to a
Volume Shadow Copy error. Norton Ghost fails for the same reason.

I'm also having trouble installing software. Group Policy has not
updated due to an error, and if I run gpreport, I get an error about
the class not being loaded. This system is a mess!

Anyway, thanks again for your help.
Joseph- Hide quoted text -

- Show quoted text -- Hide quoted text -

- Show quoted text -

 

[Ramesh, MS-MVP]

You're welcome Joseph.

--
Regards,

Ramesh Srinivasan, Microsoft MVP [Windows Shell/User]
Windows® Troubleshooting http://www.winhelponline.com


Ramesh,

I still couldn't get a proper backup with these tools, but I got close
enough. After running the secedit command, everything appeared to be
normal again.

Thank you again for your assistance!

Joseph