+ Post New Thread
Results 1 to 9 of 9
Windows 7 Thread, Logging onto Windows 7 PC's as domain administrator in Technical; Hi We've got a slight problem when logging in to our windows 7 machine, regardless of build. Certain options that ...
  1. #1

    Join Date
    May 2009
    Posts
    584
    Thank Post
    0
    Thanked 90 Times in 51 Posts
    Rep Power
    31

    Logging onto Windows 7 PC's as domain administrator

    Hi

    We've got a slight problem when logging in to our windows 7 machine, regardless of build. Certain options that should be available as an administrator are not. Ie 'Internet options' is not available, 'search' function not working. There are no restrictive policies applied to domain administrator at all.

    Anything obvious that we can start to look at? Its almost as if you are logging in as an administrator, but are not actually one!

    Thanks.

  2. #2
    Duke5A's Avatar
    Join Date
    Jul 2010
    Posts
    859
    Thank Post
    88
    Thanked 154 Times in 124 Posts
    Blog Entries
    8
    Rep Power
    36
    You can have local administrator access and still be restricted by policy. If open up RSOP.msc and drill down to the policies that control access to the areas you're having issues with, are they configured? Do you maybe have these users policies attached to a computer OU with loopback processing enabled?

  3. #3
    free780's Avatar
    Join Date
    Sep 2012
    Posts
    1,087
    Thank Post
    47
    Thanked 88 Times in 83 Posts
    Rep Power
    23
    Could be computer settings as a pose to user settings .

  4. #4

    Join Date
    Apr 2013
    Location
    Miami
    Posts
    5
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    Is this PC joined to a domain? if it is, only the server controls your Group Policies, the local policies dot not apply. Make sure are logging to the domain (domainname\administrator) and not to the local PC. Also check the User account control setting, and move the cursor all the way down to prevent the extra security over the administrators.

  5. #5

    Join Date
    Oct 2008
    Location
    Leeds
    Posts
    227
    Thank Post
    21
    Thanked 17 Times in 17 Posts
    Rep Power
    15
    Quote Originally Posted by JP_JP View Post
    Is this PC joined to a domain? if it is, only the server controls your Group Policies, the local policies dot not apply.
    Is this correct? Local GPO policies don't apply on W7 PCs when joined to a domain?

    Are you referring to computer or user settings or both?

    What about the old order of policy application rule?

    LSDO; Local, Site, Domain, OU.

    I have never actually tried modifying the local GPO on Windows 7.

    Bruce.

  6. #6

    Join Date
    May 2011
    Location
    Jus North of London, close but not too close
    Posts
    912
    Thank Post
    202
    Thanked 80 Times in 74 Posts
    Rep Power
    52
    I'd certainly agree that even as a Domain Admin doesn't mean you will have all options available when logging onto a machine and group policies would still have an effect.

    Depending what your'e OU structure is like, I'd make a policy that gives you the access to do your job and either filter it to you, an IT Support Group, or the OU you are in. You may of course be inheriting permissions from further up the tree.

  7. #7


    Join Date
    Mar 2009
    Location
    Leeds
    Posts
    7,059
    Thank Post
    232
    Thanked 926 Times in 795 Posts
    Rep Power
    309
    depending on what policies are applied to pc and user (running rsop.msc should give you a clue) you can make an administrator about as useful as guest and any domain policy will overide any local policy (though im pretty sure if all domain policies say not configured and local policy says enabled/disabled then the local policy will work)

  8. #8

    Join Date
    Oct 2008
    Posts
    226
    Thank Post
    2
    Thanked 13 Times in 13 Posts
    Rep Power
    22
    local policies most certainly DO apply. In fact they apply first. Then site/domain/OU in that order hence (as above) a "non configured" domain policy will indeed use the local settings.

    Be careful if you "lock out" local admin functions because if that PC cannot connect to the network/DC then that PC is effectively hosed (unless you can swap the local profile via linux boot CD....)

  9. #9

    Join Date
    Apr 2013
    Location
    Miami
    Posts
    5
    Thank Post
    0
    Thanked 0 Times in 0 Posts
    Rep Power
    0
    Quote Originally Posted by Bruce123 View Post
    Is this correct? Local GPO policies don't apply on W7 PCs when joined to a domain?

    Are you referring to computer or user settings or both?

    What about the old order of policy application rule?

    LSDO; Local, Site, Domain, OU.

    I have never actually tried modifying the local GPO on Windows 7.

    Bruce.
    Whenever the PC is joined to the Domain the local policies get overwritten by the GPO on the server. The Domain Controller that holds the Schema Master Role, will issue each PC all the policies, and all PCs will trust and go by the server schema and NOT the local one. If you want to go the extra mile, you can use this article to reset all local policies to default...Local Group Policy - Reset to Default - Windows 7 Help Forums. You can also unjoin the PC from the domain and see if by logging in locally you still have the same problem.



SHARE:
+ Post New Thread

Similar Threads

  1. Replies: 0
    Last Post: 6th November 2012, 04:30 PM
  2. How to find out which user last logged onto a PC (PC has gone missing)
    By bodminman in forum Windows Server 2000/2003
    Replies: 12
    Last Post: 3rd February 2012, 02:53 PM
  3. Replies: 4
    Last Post: 18th November 2011, 04:36 PM
  4. automatic VNC to PC a user is logged onto
    By ChrisP in forum How do you do....it?
    Replies: 2
    Last Post: 7th December 2007, 05:23 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •