Server restrict from domain administrator account

I have a server 192.168.1.XXX which is added in AD domain but I would like to restrict this server from domain administrator account.
192.168.1.XXX server will be access by local account only.
Please help..
You received some great suggestions and info. Curious, why would you want to remove the domain admin account from accessing the server?
Maybe a stand alone server may be a better solution? You can still access domain resources from a stand alone using specific domain accounts, but the machine won't be joined to the domain preventing the domain admin account from accessing it.
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights.

Similar Messages

Built-in domain Administrator account not given full access to new Exchange 2013 server

I migrated from Exchange 2010 to 2013 over the weekend. I cannot log into the EAC with my domain administrator account I use to log into all my other servers. I also cannot run the clean-mailboxdatabase cmdlet logged in as this user. I
had no trouble moving mailboxes from the old server to the new server with this account though.
This account is a member of: Domain Admins, Enterprise Admins, Exchange Full Admin, Exchange Organization Admin, Organization Management, Schema Admins, Server Management.
I can log into the EAC with another admin account that has the same memberships as the Administrator account.
I tried giving the account the role of "Databases" as suggested by others to fix the clean-mailboxdatabase issue but that did not work for me either.
The Administrator mailbox has been moved to the new database on the Exchange 2013 server. The Exchange 2010 has been decommissioned and is turned off.

Hi,
Based on my research, to retrieves the mailbox statistics for the disconnected mailboxes for all mailbox databases in the organization, we can try the following command:
Get-MailboxDatabase | Get-MailboxStatistics -Filter 'DisconnectDate -ne $null'
http://technet.microsoft.com/en-us/library/bb124612(v=exchg.150).aspx
Additionally, The Identity parameter specifies the disconnected mailbox in the Exchange database and it can be display name instead of mailbox GUID.
http://technet.microsoft.com/en-us/library/jj863439(v=exchg.150).aspx
Hope it can help you.
Thanks,
Angela Shi
TechNet Community Support

Domain Administrator account being locked up by PDC

Hi everyone,
My PDC is locking up my domain administrator (administrateur in french) account.
System event logs :
The SAM database was unable to lockout the account of Administrateur due to a resource error, such as a hard disk write failure (the specific error code is in the error data) . Accounts are locked after a certain number of bad passwords are provided so please
consider resetting the password of the account mentioned above.
Level : Error
Source : Directory-Services-SAM
Event ID : 12294
Computer : Contoso-PDC
User : System
There is absolutely no events in the security events log, not a single "Audit Failure" event for the "administrateur" account.
I tried to change the name of the domain administrator account from "administrateur" to "administrator".
Now there is "Audit failure" events poping up in the security event logs.
Once again the Source Workstation is the PDC. I guess those events are there because it receive credential validation for an account who doesn't exist anymore since it have been renamed in "Administrator".
Here is the detail log :
An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: Administrateur
Account Domain: CONTOSO
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xc000006d
Sub Status: 0xc0000064
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: CONTOSO-PDC
Source Network Address: -
Source Port: -
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
On the PDC i checked :
Services : None of them are started with the "administrateur" account
Network Share : There is no network share ...
Task Scheduler : None of the tasks are launch with the "administrateur" account.
And the logon type (3:network) seem to indicate that the login comes from an other computer but i have nothing to look for, not a single IP.
Any ideas?
ps : Sorry for the probable english mistakes :(

Hi,
Thanks for you answers.
San4wish :
Lockout tool confirm that the domain administrator account is locked on my PDC. I didn't run eventcomb but i though it only helped parsing security event logs which i did "manually". Anyway i'll try eventcomb after this week end.
About the conficker worm : I looked into it and this worm was exploiting a vulnerability in the server service. It have been patched by MS08-067 (KB958644) and this kb isn't available for Windows 2008 R2 and Windwos 2012 so i guess Windows 2008 R2 have
fixed this vulnerabilty.
So i doubt its a conficker type worm.
Also i gave the PDC role to another DC (let's call him DC2) and now DC2 is locking the administrator account so it seems that the computer locking the account is doing it through the network and it's not something executed on the DCs.

Cannot connect Workgroup Manager using a domain administrator account

Hello,
I'm trying to determine if this is normal behavior or something is not working right:
When using Workgroup Manager (remotely or locally on the server) it will only let me connect with the local (Netinfo) administrator account that was created upon install of the server. It will NOT let me log in with the diradmin account that was created when promoting the server to an OD master (or any other accounts I created (under the LDAP directory) and checked User can "administer the server" and "administer this directory domain").
Once connected to WGM with the local admin account I then can (and still need to) authenticate to the directory database using the diradmin account (which works). Is this normal behavior?
From reading Apple's User Management documentation it seems to indicate that once a domain administrator account is set up you can use that account to log into WGM.
Thanks in advance.
- Brian
Mac OS X (10.4.6)

OK, it looks as though I've figured this out. Using the Directory Access utility on the server itself, I needed to add the "LDAPv3/127.0.0.1" directory domain to the list of domains to search for authentication.

Built-in Domain Administrator Account Repeated Locks

This account was disabled years ago and is not used. However, event 4740 are regularly generated, It shows the calling computer name as one of our servers. So, I logged into the that server and look in the local security event log and there
are no references to account lockouts at the time the 4740s are generated on the domain controllers.
I checked for services running on the server using administrator credentials and I checked for scheduled tasks using administrator credentials and I don't see anything on the server listed as caller computer.
I renamed the "User logon name" for this account to something different so that would not longer be a match if something is try to authenticate using the logon name of "administrator." However, this has not helped. The account
still generates the 4740.
I checked the domain "Administrator" account again today and it was no longer disabled. So, I disabled it again and will see if it still gets locked out again in the next 24 hours.
How can an account with the user id changed still get locked out? It seems very strange that the account can be locked out when the user name no longer matches anything that could have ever had that user id saved.
What can be done to fix this issue?

hi,
If possible please do the following steps.
Note: here I have taken user account name as User1
1.Using ADSIEDIT changed the value of UserAccountControl attribute of the User1 account to 66082(numerical) i.e. 0x10222(in hex) and disabled it which is the sum of the following attributes:
a. ACCOUNTDISABLE; PASSWD_NOTREQD; NORMAL_ACCOUNT; DONT_EXPIRE_PASSWORD
b.
It’s current value was 0x10202 aka 66050 in dec (I believe this implies ACCOUNTDISABLE | NORMAL_ACCOUNT | DONT_EXPIRE_PASSWD)
2.   Then for the account (in ADUC) do the following:
a. Unchecked the "user cannot change password" -> OK
b. Right-clicked on the
‘user1’ account and selected reset password and kept it blank and clicked OK
i.
This step is to set a NULL password for the User1 account and keep it disabled
c.
Right-clicked on the User1 account and checked the "user cannot change password" again
https://support.microsoft.com/en-us/kb/305144?wa=wsignin1.0

Macbook air: you do not have sufficient access privileges. you need to run this game from an administrator account??? I'm already on the administrator account?

I bought a mac game from www.gamehouse.com. Downloaded it and now trying to install to play. But everytime I go to install, a message keeps popping up telling me "Your account doesn't have sufficient access privileges. You will need to run this game once from an administrator account. Afterwards you will be able to run it from this account." I am already on the administrator account. Can someone please help?!

Only the developer can fix his apparently defective product.

My FaceTime icon in settings is not clickable and the application on the home screen responds with "Account Restriction This phone is restricted from creating FaceTime accounts (I have used FT for 3 yrars and had a in order account before 8.02, this

In settings, the FaceTime icon is not clickable and in home screen the FaceTime icon (application) responds with: "Account Restriction This iPhone is restricted from making FaceTime accounts". I have had a FaceTime account in good order for 2 years now and have not abused or excessively used it. Apple doesn't respond multiple messages, ISP is of no use.

I have tried this and can see that FaceTime is ALLOWED in RESTRICTIONS
I have tried also, in restrictions, other items regarding applications, iTunes App Store without results.

PE4-Win7: Please run this program from the Administrator account so it can set up your license. Once the license is set up, you can run it from any account.

Hi,
I'm using Premiere Elements 4 in Windows 7 (64 bit). When I launch PE I get the following error:
Please run this program from the Administrator account so it can set up your license. Once the license is set up, you can run it from any account.
Any idea how to solve it?

I came across this link online. Please check it out and decide if it will or will not advance your case.
http://www.howtogeek.com/howto/windows-vista/enable-the-hidden-administrator-account-on-wi ndows-vista/
ATR

TS4268 Why my iPad is restricting from creating FaceTime account now

I was using FaceTime earlier but after video calling through yahoo messenger it is showing that "your ipad is restricted from creating FaceTime accounts".
I removed yahoo messengers thinking it may not support if we have two video calling facilities but it still shows the same problem even after in installing yahoo messenger.
How to overcome this and use both yahoo messenger and FaceTime?

I have tried this and can see that FaceTime is ALLOWED in RESTRICTIONS
I have tried also, in restrictions, other items regarding applications, iTunes App Store without results.

HT201320 i get a pop up "this iphone is restricted from creating mail accounts" ??

My new Iphone keeps popping up a message on my email "This Iphone is restricted from creating mail accounts" what canI do ?
under setting is does not let me select the "add account" or "fetch new data".

I had to completely disable all restrictions and then re-enable. General>Allow Changes>Accounts>Don't Allow Changes created the issue.

"ipod touch is restricted from creating facetime accounts"

I'm trying to use facetime on my ipod touch (which I've been able to do in the past). It now wont connect and an error message pops up saying "Account Restriction. This ipod touch is restricted from creating facetime accounts". The FaceTime emblem in the settings is also faded out, and not able to be selected. Anyone have the solution? Thanks!

Maybe:
icloud: The maximum number of free accounts have been activated on this iPhone.
http://www.ipadforums.net/icloud/68665-max-three-icloud-accounts-created-one-ios -device.html

Installing software from a Domain Administrator account

I have a machine on a domain. I have logged into that machine using a Domain Admin account, and am trying to install some software. Theoretically, a Domain Admin should have full rights on that local machine, yes? However, when I try to do that install I
get an error message:
"The system administrator has set policies to prevent this installation."
Any ideas of why this is occurring? What settings might I need to adjust to give the domain admin installation access?

It works with a local admin account. Doesn't work with domain account. I installed my first domain server 2 days ago and have no idea what I'm doing, which may be contributing to the problem, but from everything I can tell it seems like the "Domain Admins"
group has full permissions on all computers in the domain. I'm very confused why this is happening when, as you said, the domain admin should become a local admin by default (and I never messed with any default settings).
If it works with a local account, but is denied with a domain account, then it is either permissions (unlikely based on what you've described), a domain policy setting denying installations to domain accounts, or possibly some other software/security blocking
the installation.
examine the eventlogs on the pc, for events relating to the attempted installation.
these articles may help you to check for settings that can cause this, you would then need to work out where those settings are coming from, so you can consider changing them.
http://social.technet.microsoft.com/Forums/windows/en-US/6c62e6cc-7893-421d-8b90-8e14eaa1eb48/the-system-administrator-has-set-policies-to-prevent-this-installation?forum=itprovistasecurity
http://www.itninja.com/question/the-system-administrator-has-set-policies-to-prevent-this-installation-1?from=appdeploy.com
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Server 10.4.4, administrator account has "access account" disabled

Hi,
I allowed a new tech to add users to our Xserve. Somehow he disabled the check box "access acount" in workgroup manager for the only administrator account. It now appears we cannot turn this back on! The end result is you can only access workgroup manager locally.Remote desktop and VNC now won't work. We can't re-enable the "access account" option for the administrator account or create new administrators as our only administrator account is now not active. I have no idea why you should be able to do this, but duplicated the problem on a test machine. If you create an admin account and uncheck the box "access acount" then the server can no longer be adminstrated!
Any ideas?
Dave

answered my own question.
logged in as root and resolved, phew

Old domain was removed and Unable to login as domain administrator account in windows 7 laptop

I have a problem with a laptop which is in old domain, due to some issue I need to uninstall some of the programs on that machine for
that it is asking administrator password, so when I was entering old domain’s administrator account password it is not logging in, and there is no other local administrator account configured on that machine, how to log in into that machine and join that to
the new domain.
I am trying to log in as <domain-name>\administrator

Hi,
Logon to a domain with domain account is an interactive process, which needs cooperation of both DC and DNS. Since the old domain is delete, then, log in as <domain-name>\administrator to the old domain will failed.
Open CMD, type “net user”, and press Enter to display user account of this computer. Check to see if any account which has administrator permission you can remember.
Besides, type “net user administrator”, if the Account Active is YES, try to use this built-in administrator account to logon:
Press Alt + Ctrl + Delete, select Switch User -> Other User, type <computer name>\administrator. (there may be no password if you haven’t set this)
If there is no administrator permission account which you can use to logon, reinstall the system should be needed.
Best Regards,
Eve Wang

When i mail icon my phone displays a message '' account restriction - this phone is restricted from creating mail account'' this is after i deleted the mail account that was there. please help

When I press the mail icon a message '' account restriction- this iphone is restricted from creating accounts. What could be the problem?

Settings>General>Restrictions.

Server restrict from domain administrator account

Similar Messages

Maybe you are looking for