How to reset user rights in the Default Domain Controllers Group Policy object

This article was previously published under Q267553
Notice
This article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy.
This article has been archived. It is offered "as is" and will no longer be updated.
SUMMARY
The Default Domain Controllers Group Policy object (GPO) contains many default user-rights settings. In some cases, changing the default settings may produce undesirable effects. This may result in a condition where unexpected restrictions exist on the user rights. If the changes are unexpected, or if the changes were not recorded so that it is unknown which changes were made, it may be necessary to reset these user-rights settings to their defaults.

This situation may also result if the contents of the Sysvol folder were manually rebuilt, or restored from backup by using the procedures in the following article in the Microsoft Knowledge Base:
253268 Group Policy Error Message When Appropriate Sysvol Contents Are Missing
It may be also necessary to reset the SeInteractiveLogonRight and SeDenyInteractiveLogonRight user-rights settings to their defaults if you receive the following error message when you try to log on to the console of the domain controller:
The local policy of this system does not permit you to logon interactively
MORE INFORMATION
There are three steps required to reset the user rights assignments for the GPO:
  1. Log on to Directory Services Restore Mode.
  2. Edit the GptTmpl.inf file.
  3. Increment the group policy version (this change is made in the Gpt.ini).
  4. Apply the new group policy.
Note Be cautious when performing these steps. Incorrectly configuring the GPO template may render your domain controllers inoperable.
  1. Edit the GptTmpl.inf file. The User Rights settings may be reset to the defaults by editing the GptTmpl.inf file. This file is located in the Group Policy folder under the Sysvol folder:
    sysvol path\sysvol\domain name\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}\MACHINE\Microsoft\Windows NT\SecEdit
    Note The default path for the Sysvol folder is %SystemRoot%\Sysvol

    To completely reset the user rights to the default settings, replace the existing information in the GptTmpl.inf file with the following default user-rights information. You can copy, and then paste the appropriate section below into your existing GptTmpl.inf file.

    Please note the permissions settings for each template. You should use the correct template for your installation based on your desired user-rights settings.

    Note Microsoft strongly recommends backing up the GptTmpl.inf file before making these changes.

    Permissions compatible with Pre-Windows 2000 users

       [Unicode]   Unicode=yes   [Event Audit]   AuditSystemEvents = 0   AuditLogonEvents = 0   AuditObjectAccess = 0   AuditPrivilegeUse = 0   AuditPolicyChange = 0   AuditAccountManage = 0   AuditProcessTracking = 0   AuditDSAccess = 0   AuditAccountLogon = 0   [Privilege Rights]   SeAssignPrimaryTokenPrivilege =   SeAuditPrivilege =   SeBackupPrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544   SeBatchLogonRight =    SeChangeNotifyPrivilege = *S-1-5-11,*S-1-5-32-544,*S-1-1-0   SeCreatePagefilePrivilege = *S-1-5-32-544   SeCreatePermanentPrivilege =   SeCreateTokenPrivilege =   SeDebugPrivilege = *S-1-5-32-544   SeIncreaseBasePriorityPrivilege = *S-1-5-32-544   SeIncreaseQuotaPrivilege = *S-1-5-32-544   SeInteractiveLogonRight = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544   SeLoadDriverPrivilege = *S-1-5-32-544   SeLockMemoryPrivilege =   SeMachineAccountPrivilege = *S-1-5-11     SeNetworkLogonRight = *S-1-5-11,*S-1-5-32-544,*S-1-1-0   SeProfileSingleProcessPrivilege = *S-1-5-32-544   SeRemoteShutdownPrivilege = *S-1-5-32-549,*S-1-5-32-544   SeRestorePrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544   SeSecurityPrivilege = *S-1-5-32-544   SeServiceLogonRight =   SeShutdownPrivilege = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544   SeSystemEnvironmentPrivilege = *S-1-5-32-544   SeSystemProfilePrivilege = *S-1-5-32-544   SeSystemTimePrivilege = *S-1-5-32-549,*S-1-5-32-544   SeTakeOwnershipPrivilege = *S-1-5-32-544   SeTcbPrivilege =   SeDenyInteractiveLogonRight =   SeDenyBatchLogonRight =   SeDenyServiceLogonRight =   SeDenyNetworkLogonRight =   SeUndockPrivilege = *S-1-5-32-544   SeSyncAgentPrivilege =   SeEnableDelegationPrivilege = *S-1-5-32-544   [Version]   signature="$CHICAGO$"   Revision=1   [Registry Values]   MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1					
    Note If Internet Information Services is installed, you must append the following user accounts to those already listed for these rights:
       SeBatchLogonRight = IWAM_%servername%,IUSR_%servername%   SeInteractiveLogonRight = IUSR_%servername%   SeNetworkLogonRight = IWAM_%servername%,IUSR_%servername%					
    where the %servername% variable is a placeholder, and you should edit it to reflect the computer settings.

    An example would look like this:
    SeNetworkLogonRight = *S-1-5-11,*S-1-5-32-544,*S-1-1-0, IWAM_testserver1, IUSR_testserver1					
    Note If Terminal Services is installed, you must append the following user account to those already listed for this right:
       SeInteractiveLogonRight = TsInternetUser					
    An example would look like this:
    SeInteractiveLogonRight = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544, TsInternetUser					
    -or this-
    SeInteractiveLogonRight = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544,IWAM_testserver1, IUSR_testserver1,TsInternetUser					

    Permissions compatible only with Windows 2000 users

       [Unicode]   Unicode=yes    [Event Audit]   AuditSystemEvents = 0   AuditLogonEvents = 0   AuditObjectAccess = 0   AuditPrivilegeUse = 0   AuditPolicyChange = 0   AuditAccountManage = 0   AuditProcessTracking = 0   AuditDSAccess = 0     AuditAccountLogon = 0   [Privilege Rights]   SeAssignPrimaryTokenPrivilege =   SeAuditPrivilege =   SeBackupPrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544   SeBatchLogonRight =    SeChangeNotifyPrivilege = *S-1-5-11,*S-1-5-32-544,*S-1-1-0   SeCreatePagefilePrivilege = *S-1-5-32-544   SeCreatePermanentPrivilege =   SeCreateTokenPrivilege =   SeDebugPrivilege = *S-1-5-32-544   SeIncreaseBasePriorityPrivilege = *S-1-5-32-544   SeIncreaseQuotaPrivilege = *S-1-5-32-544   SeInteractiveLogonRight = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544   SeLoadDriverPrivilege = *S-1-5-32-544   SeLockMemoryPrivilege =   SeMachineAccountPrivilege = *S-1-5-11   SeNetworkLogonRight = *S-1-5-11,*S-1-5-32-544,*S-1-1-0   SeProfileSingleProcessPrivilege = *S-1-5-32-544   SeRemoteShutdownPrivilege = *S-1-5-32-549,*S-1-5-32-544   SeRestorePrivilege = *S-1-5-32-549,*S-1-5-32-551,*S-1-5-32-544   SeSecurityPrivilege = *S-1-5-32-544   SeServiceLogonRight =   SeShutdownPrivilege = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544   SeSystemEnvironmentPrivilege = *S-1-5-32-544   SeSystemProfilePrivilege = *S-1-5-32-544   SeSystemTimePrivilege = *S-1-5-32-549,*S-1-5-32-544   SeTakeOwnershipPrivilege = *S-1-5-32-544   SeTcbPrivilege =   SeDenyInteractiveLogonRight =   SeDenyBatchLogonRight =   SeDenyServiceLogonRight =   SeDenyNetworkLogonRight =   SeUndockPrivilege = *S-1-5-32-544   SeSyncAgentPrivilege =   SeEnableDelegationPrivilege = *S-1-5-32-544   [Version]   signature="$CHICAGO$"   Revision=1   [Registry Values]   MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,1					
    Note If Internet Information Services is installed, you have to add the following user rights. The servername variable is a placeholder, and you should edit it to reflect the computer settings:
       SeBatchLogonRight = IWAM_servername,IUSR_servername   SeInteractiveLogonRight = IUSR_servername   SeNetworkLogonRight = IUSR_servername					
    Save, and then close the new GptTmpl.inf file.


  2. Increment the group policy version. You must increase the group policy version to ensure that the policy changes are retained. The Gpt.ini file controls the Group Policy Template version numbers.
    1. Open the Gpt.ini file from the following location:
      sysvol path\sysvol\domain name\Policies\{6AC1786C-016F-11D2-945F-00C04fB984F9}
    2. Increase the version number to a number large enough to guarantee that normal replication will not make the new version number become outdated before the policy can be reset. It is preferable to increment the number by either adding the number "0" to the end of the version number, or the number "1" to the beginning of the version number.
    3. Save and close the Gpt.ini file.
  3. Apply the new group policy. Use Secedit to manually refresh the group policy. This can be accomplished by typing the following line at a command prompt:
    secedit /refreshpolicy machine_policy /enforce
    In Event Viewer, check the Application Log for event number "1704" to verify successful policy propagation. For more information about refreshing the group policy, click the following article number to view the article in the Microsoft Knowledge Base:
    227448 Using Secedit.exe to force group policy to be applied again
Properties

Article ID: 267553 - Last Review: 12/05/2015 20:55:01 - Revision: 4.5

Microsoft Windows 2000 Server, Microsoft Windows 2000 Advanced Server

  • kbnosurvey kbarchive kbgpo kbhowto KB267553
Feedback