Logging onto Windows 7 PC's as domain administrator

[superatticman]

Hi

 

We've got a slight problem when logging in to our windows 7 machine, regardless of build. Certain options that should be available as an administrator are not. Ie 'Internet options' is not available, 'search' function not working. There are no restrictive policies applied to domain administrator at all.

 

Anything obvious that we can start to look at? Its almost as if you are logging in as an administrator, but are not actually one!

 

Thanks.

[Duke5A]

You can have local administrator access and still be restricted by policy. If open up RSOP.msc and drill down to the policies that control access to the areas you're having issues with, are they configured? Do you maybe have these users policies attached to a computer OU with loopback processing enabled?

[free780]

Could be computer settings as a pose to user settings .

[JP_JP]

Is this PC joined to a domain? if it is, only the server controls your Group Policies, the local policies dot not apply. Make sure are logging to the domain (domainname\administrator) and not to the local PC. Also check the User account control setting, and move the cursor all the way down to prevent the extra security over the administrators.

[Bruce123]

Is this PC joined to a domain? if it is, only the server controls your Group Policies, the local policies dot not apply.

 

Is this correct? Local GPO policies don't apply on W7 PCs when joined to a domain?

 

Are you referring to computer or user settings or both?

 

What about the old order of policy application rule?

 

LSDO; Local, Site, Domain, OU.

 

I have never actually tried modifying the local GPO on Windows 7.

 

Bruce.

[Davit2005]

I'd certainly agree that even as a Domain Admin doesn't mean you will have all options available when logging onto a machine and group policies would still have an effect.

 

Depending what your'e OU structure is like, I'd make a policy that gives you the access to do your job and either filter it to you, an IT Support Group, or the OU you are in. You may of course be inheriting permissions from further up the tree.

[sted]

depending on what policies are applied to pc and user (running rsop.msc should give you a clue) you can make an administrator about as useful as guest and any domain policy will overide any local policy (though im pretty sure if all domain policies say not configured and local policy says enabled/disabled then the local policy will work)

[KK20]

local policies most certainly DO apply. In fact they apply first. Then site/domain/OU in that order hence (as above) a "non configured" domain policy will indeed use the local settings.

 

Be careful if you "lock out" local admin functions because if that PC cannot connect to the network/DC then that PC is effectively hosed (unless you can swap the local profile via linux boot CD....)

[JP_JP]

Is this correct? Local GPO policies don't apply on W7 PCs when joined to a domain?

 

Are you referring to computer or user settings or both?

 

What about the old order of policy application rule?

 

LSDO; Local, Site, Domain, OU.

 

I have never actually tried modifying the local GPO on Windows 7.

 

Bruce.

 

Whenever the PC is joined to the Domain the local policies get overwritten by the GPO on the server. The Domain Controller that holds the Schema Master Role, will issue each PC all the policies, and all PCs will trust and go by the server schema and NOT the local one. If you want to go the extra mile, you can use this article to reset all local policies to default...Local Group Policy - Reset to Default - Windows 7 Help Forums. You can also unjoin the PC from the domain and see if by logging in locally you still have the same problem.