A Freaky Microsoft Dynamics CRM Blog

my server has a DMZ and LAN connection.  a short time after enabling the dmz connection i get this error.  when i disable it functions fine again.

i am assuming by looking at the event viewer that is caused by the server attempting to contact the domain controller through the DMZ port which is impossible.

any idea on how to prevent this?

this worked.. thanks

Yes, it is works. Thanks a lot!! :-)

I work at a small tax firm and I maintain our server and workstations. Recently, I went to log onto the server computer directly and I got an error saying "Windows cannot be logged on interactively." Initally, I thought that I was on remote access on another computer station, but after I made sure I was logged out of every computer it STILL gave me that message. After I decided to stop trying to fix it, I just got lazy and started maintaining remotely (from a workstation, not the server); however, now when I try to make changes to anything in the server management window (EVEN WHEN IM LOGGED ON REMOTELY), I get a message saying:

   ACCESS IS DENIED.

    Facility: Win32

    ID no: c0070005

    Microsoft Active Directory - Exchange Extension

I think its safe to presume something mucked up the Administrator user in the sec/user/distribution groups that made the administrator computer itself work imporperly - the only problem is I CANT FIND WHAT IT IS!!!!

Could it possibly be the local policy of the server that needs to be changed??????????????????????????????????

ANY ADVICE/INPUT WOULD BE HIGHLY APPRECIATED!!!! THANKS!!!

This error was caused by my account indirectly being placed in the Guests group. Someone put Domain users in the guests group. This paralyzed just about everyone. The only way to fix it was to go into DOS and use the DSMOD Group command:

dsmod group "CN=Guests,CN=Builtin,DC=YourDomainhere,DC=COM" -rmmbr "CN=Domain Users,CN=Users,DC=YouDomainHere,DC=COM"

Re-run Exchange 2003 SP2, then KB912442 and then KB924334.  This will give you your permissions back according to http://support.microsoft.com/kb/323915.  If you do not do this and just give the permissions through registry, they will be overwritten within minutes.

Thanks you saved my life !!!!

Another way to remove the user admin from these 2 group is :

- use ADSI EDIT

- connect to domain

- navigate to the group Domain Guests (then Guests)

- right click and on properties go to members

- select the administrator account and remove

- same for Guests

- log off and on

Dear All,

I had the same issue, but i resolved thanks GOD Alhamdulillaha.

The issue happend in our case because during the backup of exchange we changed the password for the admin account which was doing backup job of exchange.

(Note: with another adminstrative account we was not having any problems)

So we changed the passord for the admin account to old password and try to open ESM and no problems.

then again we log off changed the admin password to new password and logged on with new password and open ESM without any problems.

Hope it will help.

Maqbool.

Dear All,

I had the same issue, but i can't resovle it. Even my administrator account has full permission & not member of Domain Guest or Guest.

I have installed OS

Windows Small Business Server 2003 Serveice Pack2

Microsoft Exchange Server 2003

Every thing was ok. Then what happen i don,t know. One thing to mention I have change my Administrator password. After that i m facing problem with "Acess denied" message while open Exchange System Manager.

Even i have give full permission on securepipeserver-->winreg.

Plz help me any body if u can.

Dear Adam,

         The problem u mentioned i also faced it & solve it. This is due to change Group membership of Adminsitrator account.

--> open loacal domain policy --> deny log on locally

check the group mentioned there one group of them is a one administrator is member of that. when that group e.g "Remote Desktop Operator" is deneied to log on locally the Administrator is also failed to log on locally but can access through remote.

Sol (1)

Remove all group that are mentioned in "deny log on locally" in default Domain policy. log og & then relog in

Sol (2)

Check which group is member of Administrator by open Active Directory Users & Computers--> Administrator --> Right click --> members of --> remove all group that are mentioned in deny log on locally.

Try it then feed back

Thanks Mr. mennotk,

                   I have tried rechanged Server Password back to old Password. Then restart but i have again the same problem. Message come while accesing Exchange System Manager & Active Directory Users & Computer Sanap in while right click the user properties. I get same messages in both cases.

   Facility: Win32

   ID no: c0070005

   Microsoft Active Directory - Exchange Extension

Please tell me is there no solution for this problem or I have to reinstall Active Directory & Exchange Server 2003 which is not safe for my new Job. Plz Give me a better solution If u have or consult ur colleagues. THANKS FOR YOUR COOPERATION