Greedy
Member | Редактировать | Профиль | Сообщение | Цитировать | Сообщить модератору
awsswaawsswa
Try this:
Modify the Gpttmpl.inf file to confirm that the appropriate users have the Access this computer from the network user right on the domain controller. To do this, follow these steps:
1. Modify the Gpttmpl.inf file for the Default Domain Controllers Policy. By default, the Default Domain Controllers Policy is where user rights are defined for a domain controller. By default, the Gpttmpl.inf file for the Default Domain Controllers Policy is located in the following folder.
Note Sysvol may be in a different location, but the path for the Gpttmpl.inf file will be the same.
For Windows Server 2003 domain controllers:
C:\WINDOWS\Sysvol\Sysvol\<Domainname>\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf
For Windows 2000 Server domain controllers:
C:\WINNT\Sysvol\Sysvol\<Domainname>\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf
2. To the right of the SeNetworkLogonRight entry, add the security identifiers for Administrators, for Authenticated Users, and for Everyone. See the following examples.
For Windows Server 2003 domain controllers:
SeNetworkLogonRight = *S-1-5-32-554,*S-1-5-9,*S-1-5-32-544,*S-1-1-0
For Windows 2000 Server domain controllers:
SeNetworkLogonRight = *S-1-5-11,*S-1-5-32-544,*S-1-1-0
Note Administrators (S-1-5-32-544), Authenticated Users (S-1-5-11), Everyone (S-1-1-0), and Enterprise Controllers (S-1-5-9) use well-known security identifiers that are the same in every domain.
3. Remove any entries to the right of the SeDenyNetworkLogonRight entry (Deny access to this computer from the network) to match the following example.
SeDenyNetworkLogonRight =
Note The example is the same for Windows 2000 Server and for Windows Server 2003.
By default , Windows 2000 Server has no entries in the SeDenyNetworkLogonRight entry. By default, Windows Server 2003 has only the Support_random string account in the SeDenyNetworkLogonRight entry. (The Support_random string account is used by Remote Assistance.) Because the Support_random string account uses a different security identifier (SID) in every domain, the account is not easily distinguishable from a typical user account just by looking at the SID. You may want to copy the SID to another text file, and then remove the SID from the SeDenyNetworkLogonRight entry. That way, you can put it back when you are finished troubleshooting the problem.
SeNetworkLogonRight and SeDenyNetworkLogonRight can be defined in any policy. If the previous steps do not resolve the issue, check the Gpttmpl.inf file in other policies in Sysvol to confirm that the user rights are not also being defined there. If a Gpttmpl.inf file contains no reference to SeNetworkLogonRight or to SeDenyNetworkLogonRight, those settings are not defined in the policy and that policy is not causing this issue. If those entries do exist, make sure that they match the settings listed earlier for the Default Domain Controller policy.
|
Всего записей: 317 | Зарегистр. 25-08-2004 | Отправлено: 11:25 20-09-2005 | Исправлено: Greedy, 11:26 20-09-2005 |
|
