+ Post New Thread
Results 1 to 9 of 9
Windows 7 Thread, Logging onto Windows 7 PC's as domain administrator in Technical; Hi We've got a slight problem when logging in to our windows 7 machine, regardless of build. Certain options that ...
  1. #1

    Join Date
    May 2009
    Posts
    578
    Thank Post
    0
    Thanked 89 Times in 50 Posts
    Rep Power
    30

    Logging onto Windows 7 PC's as domain administrator

    Hi

    We've got a slight problem when logging in to our windows 7 machine, regardless of build. Certain options that should be available as an administrator are not. Ie 'Internet options' is not available, 'search' function not working. There are no restrictive policies applied to domain administrator at all.

    Anything obvious that we can start to look at? Its almost as if you are logging in as an administrator, but are not actually one!

    Thanks.

  2. #2
    Duke5A's Avatar
    Join Date
    Jul 2010
    Posts
    806
    Thank Post
    83
    Thanked 132 Times in 115 Posts
    Blog Entries
    8
    Rep Power
    32
    You can have local administrator access and still be restricted by policy. If open up RSOP.msc and drill down to the policies that control access to the areas you're having issues with, are they configured? Do you maybe have these users policies attached to a computer OU with loopback processing enabled?

  3. #3
    free780's Avatar
    Join Date
    Sep 2012
    Posts
    1,008
    Thank Post
    42
    Thanked 83 Times in 79 Posts
    Rep Power
    22
    Could be computer settings as a pose to user settings .

  4. #4

    Join Date
    Apr 2013
    Location
    Miami
    Posts
    5
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    Is this PC joined to a domain? if it is, only the server controls your Group Policies, the local policies dot not apply. Make sure are logging to the domain (domainname\administrator) and not to the local PC. Also check the User account control setting, and move the cursor all the way down to prevent the extra security over the administrators.

  5. #5

    Join Date
    Oct 2008
    Location
    Leeds
    Posts
    222
    Thank Post
    21
    Thanked 17 Times in 17 Posts
    Rep Power
    14
    Quote Originally Posted by JP_JP View Post
    Is this PC joined to a domain? if it is, only the server controls your Group Policies, the local policies dot not apply.
    Is this correct? Local GPO policies don't apply on W7 PCs when joined to a domain?

    Are you referring to computer or user settings or both?

    What about the old order of policy application rule?

    LSDO; Local, Site, Domain, OU.

    I have never actually tried modifying the local GPO on Windows 7.

    Bruce.

  6. #6

    Join Date
    May 2011
    Location
    Jus North of London, close but not too close
    Posts
    791
    Thank Post
    177
    Thanked 60 Times in 57 Posts
    Rep Power
    35
    I'd certainly agree that even as a Domain Admin doesn't mean you will have all options available when logging onto a machine and group policies would still have an effect.

    Depending what your'e OU structure is like, I'd make a policy that gives you the access to do your job and either filter it to you, an IT Support Group, or the OU you are in. You may of course be inheriting permissions from further up the tree.

  7. #7


    Join Date
    Mar 2009
    Location
    Leeds
    Posts
    6,619
    Thank Post
    229
    Thanked 860 Times in 738 Posts
    Rep Power
    297
    depending on what policies are applied to pc and user (running rsop.msc should give you a clue) you can make an administrator about as useful as guest and any domain policy will overide any local policy (though im pretty sure if all domain policies say not configured and local policy says enabled/disabled then the local policy will work)

  8. #8

    Join Date
    Oct 2008
    Posts
    214
    Thank Post
    2
    Thanked 11 Times in 11 Posts
    Rep Power
    22
    local policies most certainly DO apply. In fact they apply first. Then site/domain/OU in that order hence (as above) a "non configured" domain policy will indeed use the local settings.

    Be careful if you "lock out" local admin functions because if that PC cannot connect to the network/DC then that PC is effectively hosed (unless you can swap the local profile via linux boot CD....)

  9. #9

    Join Date
    Apr 2013
    Location
    Miami
    Posts
    5
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    Quote Originally Posted by Bruce123 View Post
    Is this correct? Local GPO policies don't apply on W7 PCs when joined to a domain?

    Are you referring to computer or user settings or both?

    What about the old order of policy application rule?

    LSDO; Local, Site, Domain, OU.

    I have never actually tried modifying the local GPO on Windows 7.

    Bruce.
    Whenever the PC is joined to the Domain the local policies get overwritten by the GPO on the server. The Domain Controller that holds the Schema Master Role, will issue each PC all the policies, and all PCs will trust and go by the server schema and NOT the local one. If you want to go the extra mile, you can use this article to reset all local policies to default...Local Group Policy - Reset to Default - Windows 7 Help Forums. You can also unjoin the PC from the domain and see if by logging in locally you still have the same problem.

SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 0
    Last Post: 6th November 2012, 03:30 PM
  2. How to find out which user last logged onto a PC (PC has gone missing)
    By bodminman in forum Windows Server 2000/2003
    Replies: 12
    Last Post: 3rd February 2012, 01:53 PM
  3. Replies: 4
    Last Post: 18th November 2011, 03:36 PM
  4. automatic VNC to PC a user is logged onto
    By ChrisP in forum How do you do....it?
    Replies: 2
    Last Post: 7th December 2007, 04:23 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •