Admin rights going funny

[Tesla]

seem to currently be unable to change many settings in the control panel, they are locked down exactly like the staff's, though i am not in their group, and the domain admins gpo works for the other admins users...any ideas? (i still seem to have admin access, as I can delete wireless connections etc, which staff users can't....

[cooka]

ensure your not picking up a policy from anywhere else. do a gpresult /r and see if there is anything weird appearing.

 

Maybe do a gpupdate /force to make sure you are getting the right policy?

[Tesla]

nothing strange appearing with that gpresult tool ;picking up the itadmins gpo as i should :S

 

tried removing my self and readding to relevant groups put still unable to view anything in control panel, and as mentioned before i can still perform admins tasks, which makes it weird.

[tmcd35]

Was your user account previously in a staff OU intead of the admin OU? If so any settings applied to the account from the staff OU will not be automatically unapplied - they will remain inforce until either a) you delete your user profile and force a fresh passing of the GPO's, or b) apply new GPO's with opposite setting to those that where used in the staff OU (Enabled settings become explictly Disable, Diabled setting explicity Enabled).

 

Wherever a GPO setting is set to "Not Applied" then the last setting (Enabled/Disabled) the account encounted will remain active.

[Tesla]

That may explain it, i have had issues with my accounts recently, had to recreate my logon one or two times since i have had a windows 8 computer. and i did accidentally set it up as staff (thought it was on my previous account creation, but maybe not!)

 

If i delete my v2 folder then, will it automatically get created when i next logon? (bit uncomfortable with this on a vanilla network, had issues before. i miss our old RM days of resetting profiles!)

[tmcd35]

Yes, it will be autocreated next logon. But... you will lose anything stored in your profile (internet favourite, screen saver settings, background pic, desktop contents, etc).

 

Is it a roaming or local profile? If it's roaming then you need to make sure it is deleted from both the PC and the server. Also on the PC you need to make sure the profile is deleted from the registry as well. There is a GUI friendly way of doing this but I can't recall as I've always done it the hard way (manually delete the profile then manually edit the registry).

[Tesla]

Thanks, if that's the case, would you be able to put on here what the regedit is for it?

[tmcd35]

You need to find out what the GUID for the user account is. Should be listed in AD in the Attribute Editor tab of the user account (will need to turn on Advanced Features in AD Users & Computers view menu). Then it's just a case of finding the matching GUID in the offending computers registery under HKEY_USERS and deleting the entire subtree.

[Tesla]

Think i'm just going to create a new account for myself, may look into sorting that account out as an exercise when there's less going on.