rogue local policy

[Guest Corky D]

I was advised to post here. I have a client who has SBS 2003 r2. On the VP's

workstation, he downloaded

a cutesy screen saver. Then he removed it. Damage done! He now cant remote

into his workstation. Error message is that the local policy wont permit it!

I have logged on locally as admin and cant turn off windows firewall (greyed

out), which somehow got turned on. Ran all the virus and spyware scans.

Nothing. The remote exception is enabled. I think I might have to wipeout

his workstation and re-install. Not what I want to do. Any suggestions?

Thank You, Corky

[Guest Daniel Petri]

Can you take a look at the local GPO? Run GPEDIT.MSC and try to look at

those areas you've mentioned.

 

Also, it might be useful to find out the name and source of that bugger,

looking for more infor on dedicated forums that deal with malware removal.

 

While there is a posibility to restore at least parts of the local GPO back,

in some cases a wipe and re-install would be much simpler and safer,

especially if you've got his data backed up properly.

 

--

Daniel Petri

www.petri.co.il

 

 

 

"Corky D" <astroman707@hotmail.com> wrote in message

news:%23%23zEFHEuIHA.3792@TK2MSFTNGP02.phx.gbl...<span style="color:blue">

>I was advised to post here. I have a client who has SBS 2003 r2. On the

>VP's workstation, he downloaded

> a cutesy screen saver. Then he removed it. Damage done! He now cant remote

> into his workstation. Error message is that the local policy wont permit

> it!

> I have logged on locally as admin and cant turn off windows firewall

> (greyed

> out), which somehow got turned on. Ran all the virus and spyware scans.

> Nothing. The remote exception is enabled. I think I might have to wipeout

> his workstation and re-install. Not what I want to do. Any suggestions?

> Thank You, Corky

>

>

> </span>

[Guest PA Bear [MS MVP]]

If you must make identical posts to multiple newsgroups, please cross-post

one (1) message to all of them. Thank you.

 

Multiposting vs Crossposting:

http://www.blakjak.demon.co.uk/mul_crss.htm

--

~Robear Dyer (PA Bear)

MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002

AumHa VSOP & Admin http://aumha.net

DTS-L http://dts-l.net/

 

Corky D wrote:<span style="color:blue">

> I was advised to post here... </span>

[Guest Corky D]

Sorry, I didnt know how to cross post. Thank you for your help.

 

"PA Bear [MS MVP]" <PABearMVP@gmail.com> wrote in message

news:%23FvZp9FuIHA.4528@TK2MSFTNGP03.phx.gbl...<span style="color:blue">

> If you must make identical posts to multiple newsgroups, please cross-post

> one (1) message to all of them. Thank you.

>

> Multiposting vs Crossposting:

> http://www.blakjak.demon.co.uk/mul_crss.htm

> --

> ~Robear Dyer (PA Bear)

> MS MVP-IE, Mail, Security, Windows Desktop Experience - since 2002

> AumHa VSOP & Admin http://aumha.net

> DTS-L http://dts-l.net/

>

> Corky D wrote:<span style="color:green">

>> I was advised to post here...</span>

> </span>