Why did several administrative tools stop working after I removed the Everyone group from the "Access this computer from the network" user right?

John Savill

April 24, 2003

2 Min Read
ITPro Today logo in a gray background | ITPro Today

A. Some tools might use network API calls even though you run the tools locally. As a result, if the user doesn't have the right to access the computer from the network, the tool will fail. This problem affects the following administrative tools:

  • The Microsoft Management Console (MMC) Active Directory Sites and Services snap-in

  • The Active Directory Users and Computers snap-in

  • The Active Directory Domains and Trusts snap-in

  • Dcdiag

  • DNS Manager

  • Dsacls

  • Group Policy Editor (GPE)

  • Ldp

  • License Manager

  • Netdiag

  • Repadmin

  • Replmon

To resolve the problem, perform the following steps:

  1. Navigate to the folder

    %systemroot%SysvolSysvolDomainnamePoliciesMachineMicrosoftWindows NTSecedit

    for the policy affecting the "Access this computer from the network" user right and locate and open the gpttmpl.inf file. To determine the correct policy, you'll need to identify the appropriate globally unique identifier (GUID) for the policy. You can determine a policy's GUID by opening the Active Directory Users and Computers snap-in, displaying the container's Properties dialog box, clicking the Group Policy tab, then viewing the policy's properties. Because the Active Directory Users and Computers snap-in might not be accessible, you'll probably have to manually view each policy's GUID to identify the correct Group Policy Object (GPO).

  2. From the gpttmpl.inf file, copy everything after "SeInteractiveLogonRight=". The string of values will look similar to

    SeInteractiveLogonRight = *S-1-5-32-550,*S-1-5-32-549,*S-1-5-32-548,*S-1-5-32-551,*S-1-5-32-544,*S-1-5-21-907700337-3330534744-2079332775-1003
  3. Paste the string of values you copied from the SeInteractiveLogonRight line after the equals sign in the "SeNetworkLogonRight=" line in the gpttmpl.inf file.

  4. Save the changes, then close the gpttmpl.inf file.

  5. Locate and open the gpt.ini file at the following folder:

    %systemroot%SysvolSysvolDomainnamePolicies
  6. Increase the version number. For example, change

    [General]Version=1

    to

    [General]Version=2
  7. Save and close the file.

  8. Force a replication of the GPO by opening a command session and typing

    secedit /refreshpolicy machine_policy /enforce 

You'll now be able to use GPE to reset access for the "Access this computer from the network" user right, which is located under Computer Configuration, Windows Settings, Security Settings, Local Policies, User Rights Assignment. The default access would typically include Administrators, Enterprise Domain Controllers, and Everyone.

About the Author

Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like