Logged in as admin, but no admin rights?

[boomam]

Hi.

A while back when we got some new machines, i had to create a custom GPO on them so the drives and start menus appeared for them, as they had different setups than the rest of the machines on the network.

A niggling problem ive had since then is that even when i log into them as administrator, everythings as if im a normal user, including access rights.

 

Any idea why that happens?

 

Thanks in advance all. .

[maf_001]

This sounds like the workststion has copied the standard user account over the default user account, if this happens all the standard users gpo will apply to everyone who logs in.

 

hope this helps

[boomam]

How do i fix it then?

Copy the profile from a working profile, but change the start menu shortcuts to what i wanted them to be?

[pallen]

Have you got loopback enabled on the OU the computers are in so that settings apply to the computers regardless of user that logs on?

[elsiegee40]

Can you copy the Administrator from a similar machine that works and replace the one on the problem machine?

[boomam]

Have you got loopback enabled on the OU the computers are in so that settings apply to the computers regardless of user that logs on?

 

Yes, as at the time, using Loopbacks was the only way i could get drives and start menus to be the custom ones i wanted.

I was thinking it might be that, but have been putting off fixing it because i didnt want to faff with potentially broken shortcuts on the workstations.

[pallen]

Could you not create a policy for the admin users and put it into the same OU forcing it to overide the restrictions you set? Never really used loopback too much, but I was thinking of doing the same thing as you have to apply start menu settings for each room.

 

There is probably an easier way to do it though and i'm sure someone will suggest it.

[ChrisH]

I have had a loopback policy sting me before. I couldnt add/remove hardware as admin. Do a report in the GPMC and see what settings you are receiving and from where.

[jsnetman]

had the same problem a while ago when I messed around with the default profile. As a quick workaround I included a logon script for the admin account that deleted the contents of the registry key HKEY_CURRENT_USER\Software\Policies.

 

This removes the restriction but you must log off and back on. A bit of a pain but its better than rebuilding the whole school.

[boomam]

So your script removes those keys at each logon for administrator?

Does that affect any pupils who log on afterwards?

[jsnetman]

No because when they logon I believe the registry is rewritten with their group policy. I haven't had any problems with security using the method described in the previous post.

[boomam]

Can you post that script for me please?