securtiy policy help

[n8dawg]

ok i did somthing kinda stupid... in the mmc local security policiy there are two settings(well two setting that we will worry about)they are access local machine and deney acces to local machine...ok rdy for what i did...i deneyed access to everyone(my thinging was i would be able to get back in under local admin) but i was wrong...locked out... nobody can get in my question is after i make a local policy say lockin myself out is there away to roll back the registry with out having to log in to windows

[techleet]

NASTY!! Dude you're screwed!!

The only thing I can think of is to bootup with the Win2K cd, choose repair.

[ilovetheusers]

Yup. Yer screwed. Repair or reload. Next time you can do this but be sure to add the admin account(s) in there first before removing everyone.

[n8dawg]

thanks.. yea i figured i was screwed i didnt even wait to reimage it. it was like a homer hit me in the head... just for others to know dont "deney log on to local machine"... remove everyone from "log onto local machine" and place groups with in "log on to machine".. the only thing "deney logon to local machine" would be good for is if you had a perticular user that you didnt want to log on or a group that you didnt want access..

[silencio]

Or you could have connected to the machine remotely with the MMC.

[techleet]

</font><blockquote><font size="1" face="Trebuchet MS, Verdana, Arial, Helvetica, sans-serif">quote:</font><hr /><font size="2" face="Trebuchet MS, Verdana, Arial, Helvetica, sans-serif">Originally posted by iateyourcat:
<strong>Or you could have connected to the machine remotely with the MMC.</strong></font><hr /></blockquote><font size="2" face="Trebuchet MS, Verdana, Arial, Helvetica, sans-serif">Dude! That's EXACTLY what I was thinking but I couldn't find the right snap-in. I finally found it On another note, I know you can connect to another computer in Computer Managment MMC, but how do you do it in the regular MMC? Additionally, does Computer Managment let you change local security policies and/or add a snap-in? I can't do either.

I guess what I'm trying to say is "How the F--K can you do it??"

[silencio]

Run mmc from start/run then add a group policy snap-in. When you come to the point when you're adding the snap-in you can view by domain/ou, site, computer, or all. Under computer, you can specifiy a computer name or IP.

[futuretech]

Be very carefull when you issue a deny.If you want better security remove the everyone group, and make sure you add in just the users you want allowed access.
I do make it a habit to make sure I add the Admin after I remove the everyone group just to ensure that I have access.
If you want to manage another PC in the network, go to computer management right click on computer management (local) and select connect to another computer.If they are part of the network and you have admin priviledges this should work.

[techleet]

</font><blockquote><font size="1" face="Trebuchet MS, Verdana, Arial, Helvetica, sans-serif">quote:</font><hr /><font size="2" face="Trebuchet MS, Verdana, Arial, Helvetica, sans-serif">Originally posted by iateyourcat:
<strong>Run mmc from start/run then add a group policy snap-in. When you come to the point when you're adding the snap-in you can view by domain/ou, site, computer, or all. Under computer, you can specifiy a computer name or IP.

</strong></font><hr /></blockquote><font size="2" face="Trebuchet MS, Verdana, Arial, Helvetica, sans-serif">Score