Strange admin user

[drkestrel]

Running Windows XP Professional on a Windows Domain.

Strange behaviours:
1) Default Administrator account, when logged on, it immediately shows "Saving settings" and logged the administrator out

2) MyDomain\Me has always been a member of Administrators group on the PC, but double-clicking on Add/Remove Program", A Warning "Add or Remove Programs has been restricted. Please check with your administrator.

3.1) Logged on as MyDomain\Me to create another Local user admin2 which is member of Administrators.

3.2) admin2 tried to log on, it immediately shows "Saving settings" and logged the administrator out!

What is up? What could b wrong? Symantec Anti Virus Corporate Edition virus definition is up to date and never had any blaster, etc. virus on my PC.

Could I have locked down my machine too much accidentally? What is wrong! :-(

 

[bcastner]

Try a local console logon as Administrator. If that succeeds I suspect you have used group policy to restrict administrator accounts to local console logons only in Group Policy.

 

[drkestrel]

What "Local Console" are you talking about?

All these behaviour happens in front of my PC (not remote connection or terminal services, etc.)

 

[bcastner]

When you see the logon window scroll the Domain box and select the local console instead of a domain workstation. It is usually marked "This Workstation."

 

[drkestrel]

Sorry if I have confused you bcastner,

Administrator and admin2 are users local to my workstation running Windows XP Professional.

As such, when I log on using to my workstation using these two user IDs (instead of to my domain), I get logged out immediately!

On top of this, MyDomain\Me has been configured as member of Administrators group, but for some reasons, it doesn't have any rights to "Add/Remove Programs".

 

[bcastner]

It is pefectly possible with Domain GPOs to remove the local Administrator Group entirely, or disable it absolutely.

I suspect Group Policies at the Domain level have been implemented to essentially disable the local Administrators Group, and devolve your remaining user to the status of a limited user.

 

[drkestrel]

This has not been done at the Group Policies.

Why couldn't MyDomain\Me add/remove programs anyway?

It could do other admin stuff like Create users member of ADministrators, kill processes, change clock, etc.