Microsoft KB Archive/267553

= How to reset user rights in the Default Domain Controllers Group Policy object =

Article ID: 267553

Article Last Modified on 3/1/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server

-



This article was previously published under Q267553



SUMMARY
The Default Domain Controllers Group Policy object (GPO) contains many default user-rights settings. In some cases, changing the default settings may produce undesirable effects. This may result in a condition where unexpected restrictions exist on the user rights. If the changes are unexpected, or if the changes were not recorded so that it is unknown which changes were made, it may be necessary to reset these user-rights settings to their defaults.

This situation may also result if the contents of the Sysvol folder were manually rebuilt, or restored from backup by using the procedures in the following article in the Microsoft Knowledge Base:

253268 Group Policy Error Message When Appropriate Sysvol Contents Are Missing

It may be also necessary to reset the SeInteractiveLogonRight and SeDenyInteractiveLogonRight user-rights settings to their defaults if you receive the following error message when you try to log on to the console of the domain controller:

The local policy of this system does not permit you to logon interactively



MORE INFORMATION
There are three steps required to reset the user rights assignments for the GPO:
 * 1) Log on to Directory Services Restore Mode.
 * 2) Edit the GptTmpl.inf file.
 * 3) Increment the group policy version (this change is made in the Gpt.ini).
 * 4) Apply the new group policy.

Note Be cautious when performing these steps. Incorrectly configuring the GPO template may render your domain controllers inoperable.   Edit the GptTmpl.inf file. The User Rights settings may be reset to the defaults by editing the GptTmpl.inf file. This file is located in the Group Policy folder under the Sysvol folder:

\sysvol\ \Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\ \Microsoft\Windows NT\SecEdit

Note The default path for the Sysvol folder is %SystemRoot%\Sysvol

To completely reset the user rights to the default settings, replace the existing information in the GptTmpl.inf file with the following default user-rights information. You can copy, and then paste the appropriate section below into your existing GptTmpl.inf file.

Please note the permissions settings for each template. You should use the correct template for your installation based on your desired user-rights settings.

Note Microsoft strongly recommends backing up the GptTmpl.inf file before making these changes.

Permissions compatible with Pre-Windows 2000 users
  [Unicode] Unicode=yes [Event Audit] AuditSystemEvents = 0 AuditLogonEvents = 0 AuditObjectAccess = 0 AuditPrivilegeUse = 0 AuditPolicyChange = 0 AuditAccountManage = 0 AuditProcessTracking = 0 AuditDSAccess = 0 AuditAccountLogon = 0 [Privilege Rights] SeAssignPrimaryTokenPrivilege = SeAuditPrivilege = SeBackupPrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544 SeBatchLogonRight = SeChangeNotifyPrivilege = *S-1-5-11,*S-1-5-32-544,*S-1-1-0 SeCreatePagefilePrivilege = *S-1-5-32-544 SeCreatePermanentPrivilege = SeCreateTokenPrivilege = SeDebugPrivilege = *S-1-5-32-544 SeIncreaseBasePriorityPrivilege = *S-1-5-32-544 SeIncreaseQuotaPrivilege = *S-1-5-32-544 SeInteractiveLogonRight = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544 SeLoadDriverPrivilege = *S-1-5-32-544 SeLockMemoryPrivilege = SeMachineAccountPrivilege = *S-1-5-11 SeNetworkLogonRight = *S-1-5-11,*S-1-5-32-544,*S-1-1-0 SeProfileSingleProcessPrivilege = *S-1-5-32-544 SeRemoteShutdownPrivilege = *S-1-5-32-549,*S-1-5-32-544 SeRestorePrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544 SeSecurityPrivilege = *S-1-5-32-544 SeServiceLogonRight = SeShutdownPrivilege = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544 SeSystemEnvironmentPrivilege = *S-1-5-32-544 SeSystemProfilePrivilege = *S-1-5-32-544 SeSystemTimePrivilege = *S-1-5-32-549,*S-1-5-32-544 SeTakeOwnershipPrivilege = *S-1-5-32-544 SeTcbPrivilege = SeDenyInteractiveLogonRight = SeDenyBatchLogonRight = SeDenyServiceLogonRight = SeDenyNetworkLogonRight = SeUndockPrivilege = *S-1-5-32-544 SeSyncAgentPrivilege = SeEnableDelegationPrivilege = *S-1-5-32-544 [Version] signature=&quot;$CHICAGO$&quot; Revision=1 [Registry Values] MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1 Note If Internet Information Services is installed, you must append the following user accounts to those already listed for these rights:   SeBatchLogonRight = IWAM_%servername%,IUSR_%servername% SeInteractiveLogonRight = IUSR_%servername% SeNetworkLogonRight = IWAM_%servername%,IUSR_%servername% where the %servername% variable is a placeholder, and you should edit it to reflect the computer settings.

An example would look like this: SeNetworkLogonRight = *S-1-5-11,*S-1-5-32-544,*S-1-1-0, IWAM_testserver1, IUSR_testserver1 Note If Terminal Services is installed, you must append the following user account to those already listed for this right:   SeInteractiveLogonRight = TsInternetUser An example would look like this: SeInteractiveLogonRight = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544, TsInternetUser

-or this-

SeInteractiveLogonRight = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544,IWAM_testserver1, IUSR_testserver1,TsInternetUser

Permissions compatible only with Windows 2000 users
  [Unicode] Unicode=yes [Event Audit] AuditSystemEvents = 0 AuditLogonEvents = 0 AuditObjectAccess = 0 AuditPrivilegeUse = 0 AuditPolicyChange = 0 AuditAccountManage = 0 AuditProcessTracking = 0 AuditDSAccess = 0 AuditAccountLogon = 0 [Privilege Rights] SeAssignPrimaryTokenPrivilege = SeAuditPrivilege = SeBackupPrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544 SeBatchLogonRight = SeChangeNotifyPrivilege = *S-1-5-11,*S-1-5-32-544,*S-1-1-0 SeCreatePagefilePrivilege = *S-1-5-32-544 SeCreatePermanentPrivilege = SeCreateTokenPrivilege = SeDebugPrivilege = *S-1-5-32-544 SeIncreaseBasePriorityPrivilege = *S-1-5-32-544 SeIncreaseQuotaPrivilege = *S-1-5-32-544 SeInteractiveLogonRight = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544 SeLoadDriverPrivilege = *S-1-5-32-544 SeLockMemoryPrivilege = SeMachineAccountPrivilege = *S-1-5-11 SeNetworkLogonRight = *S-1-5-11,*S-1-5-32-544,*S-1-1-0 SeProfileSingleProcessPrivilege = *S-1-5-32-544 SeRemoteShutdownPrivilege = *S-1-5-32-549,*S-1-5-32-544 SeRestorePrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544 SeSecurityPrivilege = *S-1-5-32-544 SeServiceLogonRight = SeShutdownPrivilege = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544 SeSystemEnvironmentPrivilege = *S-1-5-32-544 SeSystemProfilePrivilege = *S-1-5-32-544 SeSystemTimePrivilege = *S-1-5-32-549,*S-1-5-32-544 SeTakeOwnershipPrivilege = *S-1-5-32-544 SeTcbPrivilege = SeDenyInteractiveLogonRight = SeDenyBatchLogonRight = SeDenyServiceLogonRight = SeDenyNetworkLogonRight = SeUndockPrivilege = *S-1-5-32-544 SeSyncAgentPrivilege = SeEnableDelegationPrivilege = *S-1-5-32-544 [Version] signature=&quot;$CHICAGO$&quot; Revision=1 [Registry Values] MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1 Note If Internet Information Services is installed, you have to add the following user rights. The servername variable is a placeholder, and you should edit it to reflect the computer settings:   SeBatchLogonRight = IWAM_servername,IUSR_servername SeInteractiveLogonRight = IUSR_servername SeNetworkLogonRight = IUSR_servername Save, and then close the new GptTmpl.inf file.

 Increment the group policy version. You must increase the group policy version to ensure that the policy changes are retained. The Gpt.ini file controls the Group Policy Template version numbers.  Open the Gpt.ini file from the following location:

sysvol path\sysvol\domain name\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}

</li> Increase the version number to a number large enough to guarantee that normal replication will not make the new version number become outdated before the policy can be reset. It is preferable to increment the number by either adding the number &quot;0&quot; to the end of the version number, or the number &quot;1&quot; to the beginning of the version number.</li> Save and close the Gpt.ini file.</li></ol> </li> Apply the new group policy. Use Secedit to manually refresh the group policy. This can be accomplished by typing the following line at a command prompt:

secedit /refreshpolicy machine_policy /enforce

In Event Viewer, check the Application Log for event number &quot;1704&quot; to verify successful policy propagation. For more information about refreshing the group policy, click the following article number to view the article in the Microsoft Knowledge Base:

227448 Using Secedit.exe to force group policy to be applied again

</li></ol>

Keywords: kbgpo kbhowto KB267553

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.