Domain Admin permissions impacted by Virus

[Rawns]

We've had a virus infection that we've managed to stop and clean up before doing too much damage, however on the DC I believe it has impacted the Domain Administrator security group permissions. Using a Domain Admin account, whenever trying to install/uninstall/repair software on the DC, I'm informed "You do not have administrator privileges". I've created a new login and added it into the Domain Admins group and have the same issue. Without wiping the server and building from scratch, is there any known way to "repair" this or identify where the issue lies?

[itwasntme]

Are you in a position to be able to revert to backups? I would be dubious about continuing with any servers that have had any form of infection - appreciate not always possible. Do you have good backups (reliable, regular, thorough)?

[3s-gtech]

Restoring DCs from backups is only done when you have none left working - you wouldn't restore a regular DC unless it served another vital role and you could manage with it being tombstoned. Try building a new VM DC - however, I suspect this permissions issue may bite again when you come to promote it.

[itwasntme]

depends on the extent of the damage, the size/complexity of the environment and how recent the backups for me, but sure, carry on

[Arthur]

Using a Domain Admin account, whenever trying to install/uninstall/repair software on the DC, I'm informed "You do not have administrator privileges".

Does it look like the virus/malware has modified the Default Domain Controller Policy and/or Default Domain Policy GPOs?

 

If so, you could recreate them with dcgpofix.

[3s-gtech]

depends on the extent of the damage, the size/complexity of the environment and how recent the backups for me, but sure, carry on

If the damage has infested the whole domain, and the downtime can be managed, then yes - a single DC can then be restored from backup as it shouldn't tombstone. That'd be my second choice after trying to rebuild though!

[MatthewL]

Is the account a member of Administrators (BULLETIN) as well as Domain Admins?

[Rawns]

Thanks for the suggestions everyone, I was hoping to try avoid downtime where possible as the site has a single server and general DC functionality is working site wide. GPOs, DNS, DHCP, Print Manager etc are all working across the school and no issues on the clients, it just seems to be a few bits of software that seem to have been impacted on the server, however I have now managed to resolve. I downloaded Microsoft's SubInACL tool and ran the following commands:

 

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=administrators=f

subinacl /subkeyreg HKEY_CURRENT_USER /grant=administrators=f

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=administrators=f

subinacl /subdirectories %SystemDrive% /grant=administrators=f

subinacl /subkeyreg HKEY_LOCAL_MACHINE /grant=system=f

subinacl /subkeyreg HKEY_CURRENT_USER /grant=system=f

subinacl /subkeyreg HKEY_CLASSES_ROOT /grant=system=f

subinacl /subdirectories %SystemDrive% /grant=system=f

 

After a reboot, everything seems to be working again. I've uninstalled the affected software successfully reinstalled so will keep an eye on it over the next week or so in case any adverse effects are felt.

[3s-gtech]

Now build a second DC, even as a VM!