🚀 go-pugleaf

> Enrique Gonzalez <reinaldo@lander.es> wrote in article
> <01bcae0e$b1da2510$880a18ac@vega>...
> > The problem is that only the administrators local group can logon on my
> of
> > my PDC, which actually
> > is the only station in the domain.
> > The rest of the accounts,guest included, get the following logon message:
> > 
> > YOUR ACCOUNT IS CONFIGURED TO PREVENT YOU FROM USING THIS WORKSTATION.
> > PLEASE TRY ANOTHER WORKSTATION.
> > 
> > But they have the right to logon locally, and to use any workstation to
> > Logon To (as specified in the account properties dialog box). Also they
> > have permission on the NETLOGON share.
> > 
> > I used the C2 configuration utility in the NT resource kit to secure the
> > machine. But
> > now I've disable everything except the Posix and OS/2 Subsystems
> features.
> > 
> > I think I had checked everything else but I'm still not getting any
> result.
> > Any ideas??....PLEASE
> > 
> > Thanks,
> > QuiQue reinaldo@lander.es
> > 


The problem is clearer now.
Thanks everybody for your help but the problem was a little bit tricky:

Using C2 Security Manager, you can set an option to halt the system when the security log
is full, preventing security events to be written. When this happens only administrators
can logon to save and clear the security log and ... changing the value of the registry
key to allow the rest of the users to log on again.



The registry key is:

CrashOnAuditFail     REG_DWORD     0 | 1 | 2

Default: 0

Path: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa

Determines whether the system halts when the Security log in Event Viewer is full. This
feature prevents unauthorised activities from occurring when they cannot be recorded in
the Security log.

Value	Meaning
0	the system does not halt when the Security log is full.
1	when the Security log is full, the system displays the message "c0000244
(STATUS_AUDIT_FAILED)" and halts. When the system is restarted, until the Security log is
cleared, only Administrators can log on.
2	the system halted in response to a full audit log. The system sets CrashOnAuditFail to
2 just before it halts. While the value of this entry is 2, LSA permits only members of
the Administrators group to logon.

To recover from a system halt resulting from a full audit log, clear the Security log and
the value of CrashOnAuditFail to 1, either running C2 Security Manager in NT 4 Resource
Kit or editing the registry.
 
For more information, see the Microsoft Knowledge Base, Article Q160783 (if you find
it�).


-- 
Thanks,
QuiQue    kkreinaldo@kklander.es
Remove both kk to use my address