Restrictions Message Nightmare

Hello everybody, I am hoping someone may be able to help with a massive problem we have in our college network.

We run a Windows XP network with 2008 server.


When users login they receive a "This operation cannot be complete due to restrictions which affect this computer message" three times. They have to hit OK three times before it logs in.

We have looked through all our gpo's and compared them with other colleges and even have outsourced tech support to come in and investigate who cannot find anything.

We are now at the stage where we are running Process Monitor to find the problem. Nothing is really coming up other than references to "winlogon.exe" and access to All Users in Docs & Settings; which we have toyed with permissions and it doesn't seem to fix.

I wondered if anyone would have any next steps we can do to try and sort this?

Many thanks

Create a duplicate ou structure with no group policys. Build up a new pc/virtual pc. Does it still do the same? if it does, do the same with the OUs for the users, and make a fresh user account in there. Then add each gp one by one until you find the one(s) that causes the problems. Do they get all the drive maps and printers they should?

The most common cause is a corrupt registry key in Internet Explorer. The registry key found at

HKEY_Local_Machine\Software\Classes\htmlfile\shell \open\command

is either damaged or corrupt.

To fix it, try resetting Web settings in Internet Explorer. If this does not resolve the issue, set IE as the default browser following the steps in Set Program Access in Control Panel. If you use a different browser as your default, you need to set IE as the default.

If you uninstalled Chrome (or Firefox) and then received the error then I will get to that in a bit.

In addition to Chrome and Firefox, other HTML rendering and editing programs may take the HTML open command and cause this error. UltraEdit is one such program.

If you received this error after uninstalling any application that takes over the HTML open command (including, but not limited to, Chrome & Firefox browsers) you may also need to change the HTM/HTML association in the registry.

Start, click Run, type Regedit in the Open box, and then click OK.
Browse to HKEY_CURRENT_USER\Software\Classes\.html
Right click the value for the .html key and select Modify…
Change the value from “ChromeHTML” to “htmlfile” (or from FireFoxHTML to htmlfile)
Repeat these steps for htm and .shtml keys if they exist. You may also want to check the xhtml and xhtm keys.

I hope that helps.

Hi thanks for that.

Will give it a try first thing Monday morning. Currently going through gpos line by line. Interesting how it does not happen as an administrator, but does for everyone else; implying it is a gpo but we just cannot find anything.

I wondered if there is anything which would be able to 'scan' when a user logs in and record any 'access denied' so we can try and find the specific thing it is trying to do.

Would it likely be the HTML issue, if it is not happening to admins?