"Some Settings are managed by your system administrator" ?

[Zezima]

Should my proxy settings be restricted within internet options? This is the Domain Controller which handles AD and DHCP mainly.

 

Any ideas why this might happen?

[mukz]

Should my proxy settings be restricted within internet options? This is the Domain Controller which handles AD and DHCP mainly.

 

Any ideas why this might happen?

 

this bloody issue is also causing me issues! it a computer on the domain with absolutely no GPOs or Local GPOs applied.

Logged in as an administrator and local admin! no luck

[Dos_Box]

No one has messed with the default domain policy have they?

[Norphy]

It's probably a local group policy then.

 

Run GPRESULT /h results.htm on the affected machine. Open the results.htm file in a browser. It will tell you what policies are being applied to the machine and which GPO they're coming from, local or central.

[mukz]

No one has messed with the default domain policy have they?

 

Not here they haven't.

[ITJS2015]

I would strip back each policy one by one but in a test OU, you will fine out then which OU is causing the problem.

 

Create an OU below the domain name with the default policy

[Zezima]

They are coming from the DC (itself) as appose to locally.

 

I wanted to login with the local administrator but I couldn't even access UAC . However now I see GPO has the "disable UAC" policy applied.

 

"117 Disable UAC" is applied to the entire domain (Xxx.internal) this is a problem because I want it to apply to everything except this server. Can I exclude the GPO from the server?

[ITJS2015]

Create a new policy with disabling UAC, don't apply it above to your default domain just leave it not configure. If you have your clients like laptops and desktop in one container just apply your new policy at the top level of the OU with out your server being in that OU.

[Zezima]

So here is the root cause ( i believe )

 

We were logging in with the incorrect DC admin account. AD by default inside the "users" folder contains a user called "administrator" (built-in account for adminstrating the computers/domain) this is how I should be logging in. Now when I log in with "administrator" I have full access to what I need. Also, I noticed when I run gpresult /h results.htm that all the user policies are gone. Shrunk from 15 policies to 0.

 

I knew my account was wrong, i just didn't know how. Originally I thought I had to be using a Local User Account which are used in Read-Only Domain Controllers but It turns out a GC Domain Controller is not the same as read-only (i wasted lots of time trying to access local user accounts).

 

Essentially I learnt today that DCs will likely have no local administrator and that AD has a "built-in" administrator which should be used for maximum access/permissions and for the sake of consistency.