Some policies greyed out David Walker <none[ at ]none.com> 12/10/2008 5:32:10 AM In Windows XP Pro, SP3, I connect to our company's domain sometimes using a VPN. Some local security policies were set for me at that time, but I don't usually log in to any domain. Since I am a remote user, my userid has now been changed to be a member of a group that doesn't have the policies applied. (I am an administrator of my computer.) Now, I would like to turn on some security settings that are unavailable to me: Such as "Interactive Logon: display user information when the session is locked". This is set to "not defined", and when I double-click the item, it shows "user display names, domain and user names" but the drop- down box is greyed out and I can't change it. How can I change this policy setting? Why is it greyed out? I tried to figure out which Registry entry controlled this setting, using some of Mark Russinovich's tools, but it appears that the "HKLM\Security \Policy" key is being read... and all of its sub-keys are encoded so their use is not obvious (which is understandable). I appreciate any help. Thanks. David Walker

Re: Some policies greyed out "Florian Frommherz [MVP]" <florian[ at ]frickelsoft.DELETETHIS.net> 12/10/2008 6:46:50 AM David, David Walker wrote: [Quoted Text] > Since I am a remote user, my userid has now been changed to be a member of > a group that doesn't have the policies applied. (I am an administrator of > my computer.) > > Now, I would like to turn on some security settings that are unavailable to > me: Such as "Interactive Logon: display user information when the session > is locked". This is set to "not defined", and when I double-click the > item, it shows "user display names, domain and user names" but the drop- > down box is greyed out and I can't change it. They're greyed out as long as there's a domain policy in place that dictates the setting. Check with RSOP.msc if there's still a policy. You may also try to create your own security template and import it using 'secedit'. If your changes get reverted, you can be sure there's still a policy in place. cheers, Florian -- Microsoft MVP - Group Policy eMail: prename [at] frickelsoft [dot] net. blog: http://www.frickelsoft.net/blog. Maillist (german): http://frickelsoft.net/cms/index.php?page=mailingliste

Re: Some policies greyed out David Walker <none[ at ]none.com> 12/18/2008 4:44:27 PM "Florian Frommherz [MVP]" <florian[ at ]frickelsoft.DELETETHIS.net> wrote in news:#8ZS9MpWJHA.2372[ at ]TK2MSFTNGP03.phx.gbl: [Quoted Text] > David, > > David Walker wrote: >> Since I am a remote user, my userid has now been changed to be a >> member of a group that doesn't have the policies applied. (I am an >> administrator of my computer.) >> >> Now, I would like to turn on some security settings that are >> unavailable to me: Such as "Interactive Logon: display user >> information when the session is locked". This is set to "not >> defined", and when I double-click the item, it shows "user display >> names, domain and user names" but the drop- down box is greyed out >> and I can't change it. > > They're greyed out as long as there's a domain policy in place that > dictates the setting. Check with RSOP.msc if there's still a policy. > You may also try to create your own security template and import it > using 'secedit'. If your changes get reverted, you can be sure there's > still a policy in place. > > cheers, > > Florian thank you for the response. But, in RSOP, under "DWalker on DWalker-c - RSOP"/Computer Configuration/Windows Settings/Security Settings/Local Policies/Security Options: (whew): Policy "Interactive Logon: display user information when the session is locked" shows Computer Setting is "Not Defined" and the Source GPO is blank. Everything is "Not Defined" and the Source GPO is blank for everything. Doesn't that mean there is not a domain policy in place? (DWalker3-c is my local computer name. I do not log in to a domain.) Confusing... David Walker