0

Okay, so I had an issue with Powershell / Task Scheduler that I posted on SO an hour ago, and one of the answer I got suggested to check my permissions.

(for the record, I'm on a corporate Windows 7 machine)

So in the Start Menu, I opened "Give administrative rights to a domain user". I then found out my user account on the CORP domain was in the group ORA_DBA, which will have been added after I installed Oracle Database. So I thought, well okay, I'm not an administrator, better fix that. I then double clicked on my user account, and changed the checkbox to "Administrator", which was perfectly fine, I logged out, logged in, et voila, no problems. Then for some reason I thought it would be a good idea to go back to the same window and change the group of my user account back to the ORA_DBA group, logged out, logged in, and then the trouble began. Where before I (think I) had some administrative rights, now nothing that requires an administrator works anymore.

For instance, I cannot add or change tasks in the task scheduler, I then get the error message:

Task Scheduler cannot apply your changes. The user account ... does not have permission to modify the task.

Also, when I go back to the user accounts window and try to change my group yet again to administrators, I get:

`The user could not be added because the following error has occured: Access denied.``

So, I think I messed things up, doing things I am not 100% sure of what I am actually doing.

I figured I would then try to inspect my restore points and roll back to a previous one. But, when I go to Control Panel > Recovery, and I click on Open System Restore, nothing happens, because I guess you need some administrative rights for this. Looking a bit further, I figured I have no way to roll back a previous restore point.

My question now consists of two parts. 1. Have I actually messed up by switching back and forth between Administrator and ORA_DBA, or could this not have been the case, and what exactly did I do wrong, and 2. can I still fix this in a way (or at least get control over Task Scheduler again)? This all keeping in mind I'm on a corporate laptop I do not have full control over.

closed as off-topic by Twisty Impersonator, fixer1234, Pimp Juice IT, G-Man, music2myear Nov 1 '17 at 16:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question is not about computer hardware or software, within the scope defined in the help center." – Twisty Impersonator, fixer1234, Pimp Juice IT, G-Man, music2myear
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Questions specific to corporate domain environments are off topic on Super User. – Twisty Impersonator Oct 25 '17 at 18:35
  • Relevant @TwistyImpersonator meta.superuser.com/questions/9252/… – music2myear Oct 25 '17 at 18:59
  • @music2myear Thanks for reminding me of that. Based on the OP asking, "can I still fix this...keeping in mind I'm on a corporate laptop I do not have full control over," I regard the question as off-topic because the correct answer requires action by corp IT. Not sure if others would agree though... – Twisty Impersonator Oct 25 '17 at 19:39
  • @TwistyImpersonator I see, however my thought was that I messed up myself, and the same could have happened on a personal computer, so maybe there also is a general solution. The reason I included the last sentence was to indicate I do not have the means to "just reset" the computer – konewka Oct 25 '17 at 19:41
  • 2
    You did well by providing all of the information. If your question is off-topic, the rationale simply comes down to the fact nobody here would be able to provide you an answer to solve your problem. In other words, "You need to have your IT department fix it" doesn't qualify as an actual solution. – Twisty Impersonator Oct 25 '17 at 19:44
3

In general, you should not be able to add your account (or any account) to the Local Admin group on your laptop unless you're already local admin on that laptop. From what you describe it sounds as though your laptop did not have correct domain policies applied and therefore allowed the first change, and then got the corrected policies and now has prevented you from setting yourself as domain admin.

I would advise that you contact your corporate IT support, let them know what you did and why. They'll either know or want to know why you were able to add your account in the first place, or if you are supposed to have admin rights, why it is not allowing you now.

Not the answer you're looking for? Browse other questions tagged or ask your own question.