Prev: ASR recovery fails - the capacity of the current system diskdrive is insufficient
Next: Installing sql svr 2005 dev edition on stand alone desktop
From: Paul Bergson [MVP-DS] on 21 Jan 2010 10:06
You are risking your company and its assets, I don't feel you are doing this
properly and it needs to be resolved. The answer I might provide might not
be popular but it is the correct one.

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

"Robert Jacobs" <robertjacobsit(a)gmail.com> wrote in message
news:e48cb556-2e2e-43f2-a075-b50912e5b455(a)b2g2000yqi.googlegroups.com...
On Jan 21, 7:31 am, "Paul Bergson [MVP-DS]" <pbbergs(a)no_spammsn.com>
wrote:
> I'm sorry if this comes across rude it is not intended to.
>
> You are handing over the keys to your enterprise by providing this sort of
> access. I don't believe you need to have this program run as a domain
> admin. All some user has to do is run a command (At this terminal) to have
> them be joined to the domain admins (DA) group and they are then full DA
> right's and can go about doing what they please anywhere in the
> enterprise.
> Putting this in a secure location means nothing. If I were your supervisor
> I would remove your admin rights and contemplate terminating you. I am
> serious!
>
> Forget about the screensaver not working and due the work to get this
> application running w/o the elevated rights.
>
> --
> Paul Bergson
> MVP - Directory Services
> MCTS, MCT, MCSE, MCSA, Security+, BS CSci
> 2008, 2003, 2000 (Early Achiever), NT4
> Microsoft's Thrive IT Pro of the Month - June 2009
>
> http://www.pbbergs.com
>
> Please no e-mails, any questions should be posted in the NewsGroup This
> posting is provided "AS IS" with no warranties, and confers no rights.
>
> "Ace Fekay [MVP-DS, MCT]" <ace...(a)mvps.RemoveThisPart.org> wrote in
> messagenews:eWFO6OfmKHA.3840(a)TK2MSFTNGP06.phx.gbl...
>
>
>
> > "Robert Jacobs" <robertjacob...(a)gmail.com> wrote in message
> >news:d977a4db-0fa2-4f7c-a2b1-10e143e4c053(a)l30g2000yqb.googlegroups.com...
> >> Hello experts - I know I'm not posting this in a Group Policy group,
> >> but there were only 6 or 7 members of those groups, so I'm guessing I
> >> might have better luck here (plus, it might not just be a group policy
> >> problem).
>
> >> On a Windows Server (2003 R1 Standard) I have setup automatic logon
> >> for a domain admin account (in a locked/secured room) that
> >> automatically launches a piece of software after logged in. The
> >> problem is, the screensaver starts after 900 seconds, and a password
> >> is required to get back into the machine afterwords. However, users
> >> who access the program launched on this computer should not be given
> >> the admin's password.
>
> >> Therefore, I added a new OU, put this domain admin's user account in
> >> the OU, and created a group policy to disable the screensaver requires
> >> password option.
>
> >> Nothing happened. I ran gpupdate /force. Nothing. I ran gpresult,
> >> and sure enough, the policy I just added did not show up. I rebooted
> >> the server, rebooted the domain server, same result.
>
> >> I then ran rsop.msc. When this box appears, red x's appear on
> >> Computer Configuration and User Configuration (as well as the top
> >> level where it says username on computername - RSoP). Clicking on any
> >> of the twisties/plus signs freezes the rsop.msc program. I right
> >> clicked User and Computer Configuration, clicked the Error Information
> >> tab, and it says:
> >> _________________________________________________
> >> Group Policy Infrastructure failed due to the error listed below.
> >> The system cannot find the path specified.
>
> >> Note: Due to the GP Core failure, none of the other Group Policy
> >> components processed their policy. Consequently, status information
> >> for the other components is not available.
> >> Additional Information:
> >> Windows cannot query for the list of Group Policy objects. Check the
> >> event log for possible messages previously logged by the policy engine
> >> that describes the reason for this.
>
> >> Windows cannot access the file gpt.ini for GPO cn=
> >> {1DDFFB81-0EE1-4103-8F53-
> >> A2C2F1ED2D21},cn=policies,cn=system,DC=domainname,DC=local. The file
> >> must be present at the location <\\domainname.local\sysvol
> >> \domainname.local\Policies\{1DDFFB81-0EE1-4103-8F53-
> >> A2C2F1ED2D21}\gpt.ini>. (The system cannot find the path specified. ).
> >> Group Policy processing aborted.
>
> >> What in the world am I supposed to do? Does it have anything to do
> >> with the auto logon feature? Where else can I look? All of your
> >> answers are GREATLY appreciated, and essential!
>
> >> Thank!
>
> > Hi Robert,
>
> > First, you could have posted this to the AD group and GPO groups, which
> > are more specific to the question. But not a prob that you posted it
> > here.
> > I actually cross-posted my response to both groups. When you reply, make
> > sure you have both groups in the "To:" field.
>
> > What I would suggest is to not host such an application on a DC. When
> > creating a GPO for users to apply for something such as this, you may
> > need
> > to use Loopback. However, I highly suggest and recommend to not do this
> > because it is a domain controller. A DC has a specific Default Domain
> > Controller Policy that affects it by default, and the loopback can
> > possibly cause problems with it.
>
> > As for the errors you are seeing, they may be stemming from an
> > underlying
> > issue that may be something more serious. To better diagnose this, we'll
> > need additional information. Please post the following:
>
> > Unedited ipconfig /all from the DC
> > Sample workstation unedited ipconfig /all
> > Event log errors on the DC (EventID# and Source name).
> > Event log errors on the workstation (EventID# and Source name).
> > Indicate how many DCs and domains you have.
>
> > Thank you,
>
> > --
> > Ace
>
> > This posting is provided "AS-IS" with no warranties or guarantees and
> > confers no rights.
>
> > Please reply back to the newsgroup or forum for collaboration benefit
> > among responding engineers, and to help others benefit from your
> > resolution.
>
> > Ace Fekay, MVP, MCT, MCITP EA, MCTS Windows 2008 & Exchange 2007, MCSE &
> > MCSA 2003/2000, MCSA Messaging 2003
> > Microsoft Certified Trainer
> > Microsoft MVP - Directory Services
>
> > If you feel this is an urgent issue and require immediate assistance,
> > please contact Microsoft PSS directly. Please check
> >http://support.microsoft.comfor regional support phone numbers.- Hide
> >quoted text -
>
> - Show quoted text -

The server is not a DC, it's simply a standard windows server with SQL
running as well as a test program - And thanks Paul for your advice on
my being fired. I would love to tell you that this is being performed
on a utility server domain (only utility servers and utility 'domain
admin' accounts are used (testing domain)), and that none of our
enterprise data is at any risk from any user at any time - and I'd
love to tell you what I'm trying to accomplish is for testing purposes
only - and would be applied on our actual domain in the future with
accounts that only have permissions to specific directories required
for that specific application to run - I'm just trying to get any bugs
worked out on our TESTING domain before attempting to go live with
COMPLETELY DIFFERENT accounts, but accounts that need to auto logon,
none-the-less. And, finally, I would like to thank you for all of
your help in resolving the issues I'm running into - you're a huge
help. Thank goodness you put all of your fancy certifications (Mr.
Early Achiever) to good use, by not asking any follow up questions, or
asking the nature of this project before telling me you are serious
about my lack of intelligence, my threat to my company, and the fact
that I should (seriously) be fired. Again - great help, MVP.


From: Phillip Windell on 21 Jan 2010 13:31
"Robert Jacobs" <robertjacobsit(a)gmail.com> wrote in message
news:e48cb556-2e2e-43f2-a075-b50912e5b455(a)b2g2000yqi.googlegroups.com...

> help. Thank goodness you put all of your fancy certifications (Mr.
> Early Achiever) to good use, by not asking any follow up questions, or
> asking the nature of this project before telling me ....

We make just as many people mad by asking those "follow up questions"
because people have no patients and want an instant answer without giving
everyone the details they need to make such an answer possible.

So from our position it is a "no win situation". Someone is going to get
ticked off no matter how we approach it.


--
Phillip Windell [not an MVP, MCSE or anything else,...the CCNA is expired]

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------


From: Robert Jacobs on 21 Jan 2010 17:27
On Jan 21, 12:31 pm, "Phillip Windell" <philwind...(a)hotmail.com>
wrote:
> "Robert Jacobs" <robertjacob...(a)gmail.com> wrote in message
>
> news:e48cb556-2e2e-43f2-a075-b50912e5b455(a)b2g2000yqi.googlegroups.com...
>
> > help.  Thank goodness you put all of your fancy certifications (Mr.
> > Early Achiever) to good use, by not asking any follow up questions, or
> > asking the nature of this project before telling me ....
>
> We make just as many people mad by asking those "follow up questions"
> because people have no patients and want an instant answer without giving
> everyone the details they need to make such an answer possible.
>
> So from our position it is a "no win situation".  Someone is going to get
> ticked off no matter how we approach it.
>
> --
> Phillip Windell [not an MVP, MCSE or anything else,...the CCNA is expired]
>
> The views expressed, are my own and not those of my employer, or Microsoft,
> or anyone else associated with me, including my cats.
> -----------------------------------------------------

However Paul decided to not ask any questions, as well as not answer
any questions - only to tell me I'm doing everything wrong. On top of
that, AFTER I informed him that the problem I'm running into is on a
test domain, and will (when implemented into our enterprise domain)
have completely different user accounts with practically no
permissions to company data or other company computers, he still
decided to tell me I'm risking my company's assets - and I still have
yet to hear one piece of advice on how to resolve my group policy
issue.

It has nothing to do with a popular or correct answer. The simple
fact is that the specialized software that is running on this computer
REQUIRES a user to be logged in at all times, REQUIRES access to only
specific folders (which WILL BE USED, NOT A DOMAIN ADMIN LIKE IN THE
TEEESSSSTTT DOMAIN), and requires other users to use the software
directly from the machine without needing the username/password of the
specialized NON ADMIN account (therefore screen shouldn't lock).
However, the Group Policy changes are not being implemented on the
computer... I'm trying to resolve this on my TEST DOMAIN before
implementing it with different accounts and permissions on my
enterprise domain - but all I hear is I should be fired. Thanks again.
From: Ace Fekay [MVP-DS, MCT] on 22 Jan 2010 10:26
> Good morning, Ace!
>
> Looks like there is no rest for the wicked!
>
> Agree with everything that you put. I read all of the posts (starting with
> your reply...did not see the original post from Robert...may be that it is
> from some other forum....). It is unfortunate that it came this far. But
> sometimes people get really frustrated and then watch out. I am fairly calm
> until I reach that point. Then you do not want to know me anymore! ;-)
>
> I hope that Robert makes things right and that Robert comes back so that we
> can actually help him. I am sure that we can...
>
> And, no worry about assumption | personal comment. I am a huge advocate of
> not assuming anything, yet do it myself all the time. And, for the record, I
> will take your 'assumption' and 'personal comment' over most people's fact
> every day of the week (and twice on Sunday). And Paul's as well. It is what
> makes you two so very good. You have both seen a ton of stuff and have done
> a ton of stuff so you can pretty much hear a couple of things and you already
> have a pretty good idea of what is going on. Now, that is not always going
> to be the case....this post is probably one of those times. I will tell you,
> when I read your initial reply (and Robert's original post) I had pretty much
> the same picture that you and - seemingly - Paul had. So, if you had that
> picture painted in your head and Paul had that picture painted in his head
> and I had that picture painted in my head........99 times out of 100 guess
> what? That picture is probably what is going on. Well, looks like maybe this
> is that 1 time out of 100. But only after more information from the poster.
>
> Look, we are all human. Well, I am pretty close to perfect.....HA! HA! I
> hope that Robert understands that it is difficult to diagnose issues when
> maybe the picture was not painted so perfectly and we all (seemingly) made a
> couple of assumptions based on years and years of experience. Robert did not
> necessarily need to react the way that he did. A simple "Hold on, guys. You
> are seeing this all wrong. Maybe I did not paint such a good picture. Okay,
> here are the details: Windows 2003 production environment, four domain
> controllers, two physical locations, two AD Sites, 110 Windows XP/Vista
> Clients and one Windows 2003 test environment......" would have sufficed. He
> could have posted the ipconfig /all results that you *always* ask to see and
> we could have gone from there. I am more than willing to give Robert the
> benefit of the doubt. I get very frustrated at times (this past weekend
> spent essentially 16 straight hours on a really bad AD issue at a new client
> - Saturday afternoon from 3PM to Sunday morning at 6:30AM, slept for three
> hours and then worked another three+ hours....was not a happy camper and
> would probably not have been too friendly).
>
> No, in my view, the point is what Robert does. How does Robert handle this?
> Does he come back and say, "FU" or does he make things right with everyone
> and start over. The ball is in his court.
>
> We all know that you and Paul are going to be here all the time. It is
> everyone else who comes and goes. Myself included!
>
> Cary

You are so right, Cary. I did try to be diplomatic and professional
about it asking for confi info, possible solutions, as well as offering
professional personal advise, but as seen, it all led from the original
posts abiquity.

However at this point, I think we can put this past us for now and move
on, and look at it as a learning experience.

And I'm not sure what happened to the original post. I think it's
because Robert is using Google Groups. Google has a way of skewing
posts. If you've ever noticed with using Windows Mail or Outlook
Express as a reader, it can't handle Google's settings. Google does
things differently with posts, such as truncating responses and links
in the responses, as well as not able to properly reply with Outlook Ex
or Windows Mail where the right arrow carots (">") don't show up, even
if you set your settings to HTML, which usually is not "proper"
etiquette with newsgroups. What I do when it comes to replying to
Google Groups postings is use MesNews, which handles and alters Google
formats very well back to a true newsgroup encoding that Google seems
to try and override all the time.

Cheers!!!

Ace


From: Cary Shultz on 22 Jan 2010 12:00
Yeppers.....all is well that ends well.

Already forgotten! ;-)

"Ace Fekay [MVP-DS"; "MCT]" <aceman(a)mvps.RemoveThisPart.org> wrote in
message news:mn.b2727da1a9eea830.105663(a)mvps.RemoveThisPart.org...
>> Good morning, Ace!
>>
>> Looks like there is no rest for the wicked!
>>
>> Agree with everything that you put. I read all of the posts (starting
>> with your reply...did not see the original post from Robert...may be that
>> it is from some other forum....). It is unfortunate that it came this
>> far. But sometimes people get really frustrated and then watch out. I
>> am fairly calm until I reach that point. Then you do not want to know me
>> anymore! ;-)
>>
>> I hope that Robert makes things right and that Robert comes back so that
>> we can actually help him. I am sure that we can...
>>
>> And, no worry about assumption | personal comment. I am a huge advocate
>> of not assuming anything, yet do it myself all the time. And, for the
>> record, I will take your 'assumption' and 'personal comment' over most
>> people's fact every day of the week (and twice on Sunday). And Paul's as
>> well. It is what makes you two so very good. You have both seen a ton
>> of stuff and have done a ton of stuff so you can pretty much hear a
>> couple of things and you already have a pretty good idea of what is going
>> on. Now, that is not always going to be the case....this post is
>> probably one of those times. I will tell you, when I read your initial
>> reply (and Robert's original post) I had pretty much the same picture
>> that you and - seemingly - Paul had. So, if you had that picture painted
>> in your head and Paul had that picture painted in his head and I had that
>> picture painted in my head........99 times out of 100 guess what? That
>> picture is probably what is going on. Well, looks like maybe this is that
>> 1 time out of 100. But only after more information from the poster.
>>
>> Look, we are all human. Well, I am pretty close to perfect.....HA! HA!
>> I hope that Robert understands that it is difficult to diagnose issues
>> when maybe the picture was not painted so perfectly and we all
>> (seemingly) made a couple of assumptions based on years and years of
>> experience. Robert did not necessarily need to react the way that he
>> did. A simple "Hold on, guys. You are seeing this all wrong. Maybe I
>> did not paint such a good picture. Okay, here are the details: Windows
>> 2003 production environment, four domain controllers, two physical
>> locations, two AD Sites, 110 Windows XP/Vista Clients and one Windows
>> 2003 test environment......" would have sufficed. He could have posted
>> the ipconfig /all results that you *always* ask to see and we could have
>> gone from there. I am more than willing to give Robert the benefit of
>> the doubt. I get very frustrated at times (this past weekend spent
>> essentially 16 straight hours on a really bad AD issue at a new client -
>> Saturday afternoon from 3PM to Sunday morning at 6:30AM, slept for three
>> hours and then worked another three+ hours....was not a happy camper and
>> would probably not have been too friendly).
>>
>> No, in my view, the point is what Robert does. How does Robert handle
>> this? Does he come back and say, "FU" or does he make things right with
>> everyone and start over. The ball is in his court.
>>
>> We all know that you and Paul are going to be here all the time. It is
>> everyone else who comes and goes. Myself included!
>>
>> Cary
>
> You are so right, Cary. I did try to be diplomatic and professional about
> it asking for confi info, possible solutions, as well as offering
> professional personal advise, but as seen, it all led from the original
> posts abiquity.
>
> However at this point, I think we can put this past us for now and move
> on, and look at it as a learning experience.
>
> And I'm not sure what happened to the original post. I think it's because
> Robert is using Google Groups. Google has a way of skewing posts. If
> you've ever noticed with using Windows Mail or Outlook Express as a
> reader, it can't handle Google's settings. Google does things differently
> with posts, such as truncating responses and links in the responses, as
> well as not able to properly reply with Outlook Ex or Windows Mail where
> the right arrow carots (">") don't show up, even if you set your settings
> to HTML, which usually is not "proper" etiquette with newsgroups. What I
> do when it comes to replying to Google Groups postings is use MesNews,
> which handles and alters Google formats very well back to a true newsgroup
> encoding that Google seems to try and override all the time.
>
> Cheers!!!
>
> Ace
>
>

First  |  Prev  | 
Pages: 1 2
Prev: ASR recovery fails - the capacity of the current system diskdrive is insufficient
Next: Installing sql svr 2005 dev edition on stand alone desktop