Default Domain Policy misconfigured — Domain Admins & Enterprise Admins added to DENY logon settings, locking all admin access

Question

Default Domain Policy misconfigured — Domain Admins & Enterprise Admins added to DENY logon settings, locking all admin access

Al Aguilar 0

Hello, I need help recovering my Active Directory domain after an incorrect settings change was applied to the Default Domain Policy (DGP {31B2F340-016D-11D2-945F-00C04FB984F9}).

A change was made to the GPO’s security policy that added multiple Deny entries affecting administrative accounts. Specifically:

Both “Domain Admins” and “Enterprise Admins” were added to these policies:

Deny log on locally

Deny log on through Remote Desktop Services

Deny access to this computer from the network

As soon as the policy applied, every domain administrator account was locked out of every domain controller, both locally and over RDP.

This includes all privileged groups because:

Domain Admins SID = S-1-5-21-…-512

Enterprise Admins SID = S-1-5-21-…-519

Both appear inside the Default Domain Policy’s GptTmpl.inf under MACHINE\Microsoft\Windows NT\SecEdit

Al Aguilar 0 Reputation points

2025-11-28T07:25:35.6366667+00:00

I found 2 policies under SYSVOL and removed the one I believed was the only one denying Domain Admins. However, I found that the default policy had the entries added. 512 and 519 SIDs were identified. I'm thinking of resetting the Default Domain policy, but not sure if using DSRM on Windows Server 2022 will work. How will it affect other GPO's outside of the default policy? (Wallpaper, BGINFO, etc...)
Al Aguilar 0 Reputation points

2025-11-28T07:55:00.7333333+00:00

2 answers

Your answer

Al Aguilar 0 Reputation points

2025-11-28T07:25:35.6366667+00:00

I found 2 policies under SYSVOL and removed the one I believed was the only one denying Domain Admins. However, I found that the default policy had the entries added. 512 and 519 SIDs were identified. I'm thinking of resetting the Default Domain policy, but not sure if using DSRM on Windows Server 2022 will work. How will it affect other GPO's outside of the default policy? (Wallpaper, BGINFO, etc...)
Al Aguilar 0 Reputation points

2025-11-28T07:55:00.7333333+00:00

Answer 1

Marcin Policht 67,980 MVP Volunteer Moderator

Resetting the Default Domain Policy should work. This should have no impact on other GPOs (other than Default Domain Policy and Default Domain Controllers Policy)

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin

Answer 2

Hi sir.

Thank you for your contribution to the community

To address the issue, please help try remove the incorrect settings, this could avoid causing impact on other GPOs.

Then, run gpupdate /force for the new setting to be applied.

Verify effective rights (perform on all DCs):

gpresult /h C:\temp\gp.html

Force DFSR to poll Active Directory for changes:

dfsrdiag pollad

If you believe this information adds some value, please accept the answer so that your experience with the issue would help contribute to the whole community.

Best wishes,

Kate!

Share via

Default Domain Policy misconfigured — Domain Admins & Enterprise Admins added to DENY logon settings, locking all admin access

2 answers

Your answer