Click here to get back home

Domain Controller Security Policy
 Home | NewsGroups | Search | About
Login Password
Register Now!
 microsoft.public.windows.server.security    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content
Subject Author Date
Domain Controller Security Policy Eric Eickhoff 08-12-2005
Posted by Eric Eickhoff on August 12, 2005, 4:31 pm
Please log in for more thread options
 Greetings,

I am stumped as to whether or not this can be resolved, but a client set the
Rename Administrator Account setting in the Domain Controller Security
Policy to a name containing the '@' character. Of course now, she can't log
on to the domain with that account and as luck would have it -- she doesn't
have any other accounts with domain admin privelages and this is the only
domain controller. It is a W2K3 DC. Does anyone know if the DC Security
Policy can be reset -- at least the Rename Admininstrator Account setting (I
know -- this sounds fishy from a security standpoint and truly don't expect
an answer on that one) or is there a way to log on to the system using the
account name with '@' signs in it. I had her try entering
DOMAIN\@ministrator in the username with no luck. I am assumming that it is
looking at the information after the '@' sign as being the domain info and
that is why it is failing. She does have the password for the Active
Directory Restore Mode if it helps.

Anyone have any insight?




Posted by Roger Abell on August 13, 2005, 7:07 am
Please log in for more thread options
 As she has the ADRM password, if she also has backup to
use that is fresh enough, then your best route may be to restore
the GPO(s) on the DC OU to point before she did the rename.
Otherwise, I am not sure, but doubtful, whether you could in
ADRM get at just that policy or its value (the @dm name), or
the enable/disable attribute of the GPO link to the OU, etc..

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
> Greetings,
>
> I am stumped as to whether or not this can be resolved, but a client set
the
> Rename Administrator Account setting in the Domain Controller Security
> Policy to a name containing the '@' character. Of course now, she can't
log
> on to the domain with that account and as luck would have it -- she
doesn't
> have any other accounts with domain admin privelages and this is the only
> domain controller. It is a W2K3 DC. Does anyone know if the DC Security
> Policy can be reset -- at least the Rename Admininstrator Account setting
(I
> know -- this sounds fishy from a security standpoint and truly don't
expect
> an answer on that one) or is there a way to log on to the system using the
> account name with '@' signs in it. I had her try entering
> DOMAIN\@ministrator in the username with no luck. I am assumming that it
is
> looking at the information after the '@' sign as being the domain info and
> that is why it is failing. She does have the password for the Active
> Directory Restore Mode if it helps.
>
> Anyone have any insight?
>
>




Posted by Per Pedersen on August 13, 2005, 9:14 am
Please log in for more thread options
Since booting into ADRM using the ADRM password logs you on indirectly with
the Administrator account, you could try to create a new "backup"
administrator account using "net user /add" in command prompt and add this
to the "Administrators" group, also when booting into ADRM. You can then
logon using this account in "normal" boot and change the original
Administrators name.


> Greetings,
>
> I am stumped as to whether or not this can be resolved, but a client set
> the Rename Administrator Account setting in the Domain Controller Security
> Policy to a name containing the '@' character. Of course now, she can't
> log on to the domain with that account and as luck would have it -- she
> doesn't have any other accounts with domain admin privelages and this is
> the only domain controller. It is a W2K3 DC. Does anyone know if the DC
> Security Policy can be reset -- at least the Rename Admininstrator Account
> setting (I know -- this sounds fishy from a security standpoint and truly
> don't expect an answer on that one) or is there a way to log on to the
> system using the account name with '@' signs in it. I had her try
> entering DOMAIN\@ministrator in the username with no luck. I am assumming
> that it is looking at the information after the '@' sign as being the
> domain info and that is why it is failing. She does have the password for
> the Active Directory Restore Mode if it helps.
>
> Anyone have any insight?
>




Posted by Roger Abell on August 13, 2005, 6:35 am
Please log in for more thread options
I do not believe that is a viable route, as the ADRM is using
the old local SAM so the account will not be in AD.

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
> Since booting into ADRM using the ADRM password logs you on indirectly
with
> the Administrator account, you could try to create a new "backup"
> administrator account using "net user /add" in command prompt and add this
> to the "Administrators" group, also when booting into ADRM. You can then
> logon using this account in "normal" boot and change the original
> Administrators name.
>
>
> > Greetings,
> >
> > I am stumped as to whether or not this can be resolved, but a client set
> > the Rename Administrator Account setting in the Domain Controller
Security
> > Policy to a name containing the '@' character. Of course now, she can't
> > log on to the domain with that account and as luck would have it -- she
> > doesn't have any other accounts with domain admin privelages and this is
> > the only domain controller. It is a W2K3 DC. Does anyone know if the
DC
> > Security Policy can be reset -- at least the Rename Admininstrator
Account
> > setting (I know -- this sounds fishy from a security standpoint and
truly
> > don't expect an answer on that one) or is there a way to log on to the
> > system using the account name with '@' signs in it. I had her try
> > entering DOMAIN\@ministrator in the username with no luck. I am
assumming
> > that it is looking at the information after the '@' sign as being the
> > domain info and that is why it is failing. She does have the password
for
> > the Active Directory Restore Mode if it helps.
> >
> > Anyone have any insight?
> >
>
>




Posted by Steven L Umbach on August 14, 2005, 9:38 pm
Please log in for more thread options
The problem is that @ is used for UPN logon which expects a domain name
after the @. I believe that the security option for change administrator
password may change only the old "pre Windows 2000" type logon name as shown
in a users account properties. It may be worth a try for her to try and
logon via UPN as in administrator@mydomain.com since the UPN logon name for
administrator may have not been changed. Another thing that may work if that
fails is to find the GptTmpl.inf file for the policy she configured, delete
the line for rename administrator account, and bump up the version number in
the GPT.ini file. The link below refers to some of what I mentioned on
editing such files including where they are and may be helpful. You could
place the hard drive from here domain controller into another computer as a
secondary/slave drive to edit those files if you can not do it any other way
such as via Recovery Console or a bootable cdrom such as Barts PE. ---
Steve

http://support.microsoft.com/?kbid=226243
http://support.microsoft.com/?kbid=267553
http://www.nu2.nu/pebuilder/ --- Barts PE bootable CD/DVD

> Greetings,
>
> I am stumped as to whether or not this can be resolved, but a client set
> the Rename Administrator Account setting in the Domain Controller Security
> Policy to a name containing the '@' character. Of course now, she can't
> log on to the domain with that account and as luck would have it -- she
> doesn't have any other accounts with domain admin privelages and this is
> the only domain controller. It is a W2K3 DC. Does anyone know if the DC
> Security Policy can be reset -- at least the Rename Admininstrator Account
> setting (I know -- this sounds fishy from a security standpoint and truly
> don't expect an answer on that one) or is there a way to log on to the
> system using the account name with '@' signs in it. I had her try
> entering DOMAIN\@ministrator in the username with no luck. I am assumming
> that it is looking at the information after the '@' sign as being the
> domain info and that is why it is failing. She does have the password for
> the Active Directory Restore Mode if it helps.
>
> Anyone have any insight?
>




Similar ThreadsPosted
Domain Controller Policy setting "Allow log on through Terminal Services" April 1, 2008, 12:01 pm
Domain Controller Security January 13, 2006, 4:43 pm
Domain Security Policy -> Access is denied for Administrator July 17, 2006, 7:04 am
Domain Controller That Service a DMZ October 29, 2005, 9:58 pm
Want to make an Admin for only one Domain Controller April 7, 2006, 4:42 pm
Client and Domain controller across a firewall March 31, 2008, 5:32 am
2003 Domain Controller not requesting certificate May 31, 2006, 2:53 pm
Windows 2003 Domain Controller (Open Port 593) December 18, 2006, 4:48 pm
2003 Domain Controller event id when an account is locked ? January 3, 2007, 4:16 am
Domain Controller Certificates and moving to a new server or removing them? April 23, 2007, 2:42 pm

Our other projects:

Art Dolls, Fairies and Mermaids - Sunnyfaces.net

Roy's Linux, Programming and Search Engines messages

1-Script XML SitemapXML Sitemap