I'm sure this is simple, but I don't know where to look. I'm a domain admin, but when I log into this server I don't have access to things like the registry, or command prompt, or My Computer's Properties. Just certain important functions are denied. I am listed in the local Administrators group, so what else is there to do? To get around this problem temporarily, I just added a new local windows user on the server and did all my registry changes etc... , then deleted that user when i was done. That temporary local user had all access, but my original domain admin user does not.

Open up command prompt and key in 'gpresult', review the group membersihps & settings for your account which is a member of the DA gorup, and take a look at the RSOP for your account on that specific server. Review the GPO settings that are being applied to your server or user account which are resulting in this issue.

It's a good idea for admins to have two accounts. One for use as a normal user and one for admin. You can login in the morning with your normal user account, send/ rec mail, etc., and when you need to do an admin function "run as" or RDP into a server with your admin account. Admin accounts should be outside the scope of normal user group policies. It sounds like your user account may have restrictions from a group policy as suggested by cscharr. Or there are explicit restrictions for your account on this particular server.

ok, now i see it. I opened up the RSOP for my account and can see the restrictions for the group "vendors". This is not actually my own server, it's a customer's of mine and they let me on it to install software etc. However, they made me an administrator thinking that would give me access to everything, but I'm part of this "vendors" group which has those restrictions. To take me out of this group is this something I can change myself from this server? or do I need to be on the domain controller to change that?

You use AD Users and Computers, find your user object, go to the member of tab, and remove yourself from the group vendors. You can run ADUC fron any machine the admin.pac is installed. Or you can RDP into the DC and run ADUC unless being in the vendors group prevents you from logging on.

Hi, You can ask them to remove you from vendors group as Roy suggested or edit the GPO that restrict you. You’d better ask your customer’s opinion first and let them make the decision. Thanks.This posting is provided "AS IS" with no warranties, and confers no rights. Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Make sure that your administrator is member of the folowing groups: -Administrators -Domain Admins -Domain Users -Enterprise Admins -Group Policy Creator Owners -Scheme Admins These groups will allow your user account to administer the most objects of your domain. Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. Best regards.

Dave, were you able to remove yourself from the vendors group and gain access to the things you were denied?

Have your problem been solved? If it is not, we are waiting for you to give help. Best regards.

o sorry, i've been busy with so many other customers I haven't had a chance to log on and test it. I'll let you know when I can get to it. Thanks Guys