Revoked administrator rights on a corporate laptop

0

Okay, so I had an issue with Powershell / Task Scheduler that I posted on SO an hour ago, and one of the answer I got suggested to check my permissions.

(for the record, I'm on a corporate Windows 7 machine)

So in the Start Menu, I opened "Give administrative rights to a domain user". I then found out my user account on the CORP domain was in the group ORA_DBA, which will have been added after I installed Oracle Database. So I thought, well okay, I'm not an administrator, better fix that. I then double clicked on my user account, and changed the checkbox to "Administrator", which was perfectly fine, I logged out, logged in, et voila, no problems. Then for some reason I thought it would be a good idea to go back to the same window and change the group of my user account back to the ORA_DBA group, logged out, logged in, and then the trouble began. Where before I (think I) had some administrative rights, now nothing that requires an administrator works anymore.

For instance, I cannot add or change tasks in the task scheduler, I then get the error message:

Task Scheduler cannot apply your changes. The user account ... does not have permission to modify the task.

Also, when I go back to the user accounts window and try to change my group yet again to administrators, I get:

`The user could not be added because the following error has occured: Access denied.``

So, I think I messed things up, doing things I am not 100% sure of what I am actually doing.

I figured I would then try to inspect my restore points and roll back to a previous one. But, when I go to Control Panel > Recovery, and I click on Open System Restore, nothing happens, because I guess you need some administrative rights for this. Looking a bit further, I figured I have no way to roll back a previous restore point.

My question now consists of two parts. 1. Have I actually messed up by switching back and forth between Administrator and ORA_DBA, or could this not have been the case, and what exactly did I do wrong, and 2. can I still fix this in a way (or at least get control over Task Scheduler again)? This all keeping in mind I'm on a corporate laptop I do not have full control over.

konewka

Posted 2017-10-25T17:25:28.083

Reputation: 111

Question was closed 2017-11-01T16:55:08.627

Questions specific to corporate domain environments are off topic on Super User. – I say Reinstate Monica – 2017-10-25T18:35:15.043

Relevant @TwistyImpersonator https://meta.superuser.com/questions/9252/what-is-the-definition-of-corporate-it-support

– music2myear – 2017-10-25T18:59:34.810

@music2myear Thanks for reminding me of that. Based on the OP asking, "can I still fix this...keeping in mind I'm on a corporate laptop I do not have full control over," I regard the question as off-topic because the correct answer requires action by corp IT. Not sure if others would agree though... – I say Reinstate Monica – 2017-10-25T19:39:43.330

@TwistyImpersonator I see, however my thought was that I messed up myself, and the same could have happened on a personal computer, so maybe there also is a general solution. The reason I included the last sentence was to indicate I do not have the means to "just reset" the computer – konewka – 2017-10-25T19:41:04.893

2You did well by providing all of the information. If your question is off-topic, the rationale simply comes down to the fact nobody here would be able to provide you an answer to solve your problem. In other words, "You need to have your IT department fix it" doesn't qualify as an actual solution. – I say Reinstate Monica – 2017-10-25T19:44:55.043

I cannot reiterate enough that you should contact your IT Administrator and ask for assistance in correcting your machine's configuration. As a non-Administrator on the domain you will be unable to perform the required functions to solve the issues you describe. Even if you have the permission you don't have the required knowledge to fix it yourself we shouldn't be attempting to fix your machine's configuration on a corporate domain since we don't have the information or access required to tell you precisely what to do in order to fix your configuration problems. – Ramhound – 2017-10-25T20:11:36.723

It's indeed the first thing I'll do in the morning! – konewka – 2017-10-25T20:13:35.870

Possibly related: How do I reset the Windows XP Administrator password?,  Recover Windows 7 password of admin account (unfortunately, this one assumes that you still have admin access, and have lost only the password), and How to get rights of admin after I disabled all admin accounts in my computer (which is written for Windows 10, but may be usable for Windows 7).

– G-Man Says 'Reinstate Monica' – 2017-10-31T05:28:10.583

Answers

3

In general, you should not be able to add your account (or any account) to the Local Admin group on your laptop unless you're already local admin on that laptop. From what you describe it sounds as though your laptop did not have correct domain policies applied and therefore allowed the first change, and then got the corrected policies and now has prevented you from setting yourself as domain admin.

I would advise that you contact your corporate IT support, let them know what you did and why. They'll either know or want to know why you were able to add your account in the first place, or if you are supposed to have admin rights, why it is not allowing you now.

music2myear

Posted 2017-10-25T17:25:28.083

Reputation: 34 957