I have created a VM for Win XP which is running now in a Win 8 host system using Hyper-V.

This Win XP VM was initially connected to the my company's domain but now disconnected and is part of the workgroup. But it seems some of the old group policies are still being applied in some way in this VM.

The test user (local user on the VM) we use for this VM keeps losing Admin rights every now and then and I have to login as the local Administrator everytime to enable the admin rights again. We have a scenario like this in 5 VMs and I can't keep on logging in to all the PCs when this issue arises (I am managing the VMs and others in my team use them).

So, I would like to know if there is a single point in Windows XP where we can disable any domain group policy completely as I am not sure why the user keeps losing admin rights eventhough the system is in Workgroup. Does corporate network admins even control the ones that are not in domain ?

I know some obvious answers like contacting the IT team etc. which I am sure will take weeks in the current situation due to policy, rules etc. I need a self-solve kind of a solution. Please suggest me a way forward.

  • Are you trying to remove the GP settings, or just block future settings? – music2myear Oct 31 '14 at 17:48
  • I need to remove the GP settings done by the Group policy but apparently the IT team (bunch of morons) is doing more than the group policy since the issue happens for the new user created now when the VM is in workgroup.. – Rajesh Nov 3 '14 at 11:20

For Windows XP:

As an administrator, run the following command in the command prompt:

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

This will reset most GP settings, including all security settings, to their pre-domain-joined state.

For Vista and later:

secedit /configure /cfg %windir%\inf\defltbase.inf /db defltbase.sdb /verbose

Thanks to: http://helpdeskgeek.com/how-to/reset-local-security-policy/

|improve this answer|||||
  • Nice. Does this only do "Security" settings, or does it also revert other GPOs as well (say, program-specific policies that affect non-security settings)? – Ƭᴇcʜιᴇ007 Oct 31 '14 at 17:56
  • That I do not actually know. Do you mean programs that have GP templates written for them that may be employed in a given environment, like Adobe Acrobat and the like? Yea, I don't know what is stored in the secedit db, just that this script has saved my bacon many a time (changing local admin passwords where the domain has too-strict password requirements and the like). – music2myear Oct 31 '14 at 18:00
  • 1
    That's mostly what I meant. I guess it could also include in-built Windows program settings, like say Offline Files settings, or System Restore Point settings.. Regardless, good to know... :) – Ƭᴇcʜιᴇ007 Oct 31 '14 at 18:11
  • I remember looking for this at a previous job and being so very excited when I discovered it was truly possible. – music2myear Oct 31 '14 at 19:53
  • Thank you for the response. I tried to run this command but it states 'System cannot find the file specified' error. I checked the system and there is no 'inf' folder under %windir%. Should some feature be turned ON to get this folder ? – Rajesh Nov 3 '14 at 8:45

Nope, the polices did their job and changed the settings that applied to that policy. Those settings will stick until changed back (either by another policy, or manually).

Perhaps the easiest away to ensure all possible settings that could be set by GP are back to defaults, is to reinstall the OS.

Otherwise, to start in on your specific problem, you need to determine why that user is losing admin access, if it's specific to that one user, and if (left over) GP settings are the root.

Couple things to start with:

  • Determine if it's just that Test user that the problem: Make a new user account, add it to the Admin group, and see if their admin access sticks.

  • Start confirming your GP theory, use RSOP.MSC and GPResult to figure out if anything is still being applied. Specifically check for things set in Computer Configuration\Windows Settings\Security Settings\Restricted Groups, as that's how you force users in and out of local groups on a domain.

|improve this answer|||||
  • Thank you for the response. I will check the 2 things you mentioned and will revert back. – Rajesh Oct 31 '14 at 17:06
  • Actually, you can remove all GP settings without reinstalling windows. Windows backs up the security database when changes are made, and this can be reverted. Gimme a minute to find the methods I've used before successfully. – music2myear Oct 31 '14 at 17:49
  • I tried to create a new local user and the same issue happens to the new user also. Apparently the network admins control even those in the workgroup in my company. I am yet to try the second option. I will try and revert. Thank you for all the responses. – Rajesh Nov 3 '14 at 9:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.