Local security w2k question

Hi all,

I just got a hard drive image from a customer, and I need to replicate a problem they're having regarding screen savers in non-administrator logins. However, the problem is that the security policy is set so tight for non-admins that I can't enable the screen saver (or even right click on the desktop) in any non-admin account. How can I change this policy? I can't see anything regarding this under Administrative Tools -> Local Security Policies... I know it's probably called something else, but I don't know what.

Any helps, as always, is greatly appreciated.

Thanks,
ik

[edit] a google search turned up nothing [/edit]

You will need to run the local security policy MMC (gpedit.msc) and change the policy. This must be done as the admin. Do this in the start > run field.

--TH13

...and once there (gpedit.msc), you go to:

User Configuration-Administrative Templates-Control Panel-Display

Thank you both. Out of curiosity, how did you guys find out that you have to run gpedit.msc? I searched through the windows help files, but it turned up nothing (probably used wrong keywords). Is there some place I can look up these things?

I did find another way to get the same panel, just running MMC, adding the necessary panels, etc... How did you figure out to run that file? Are there other shortcuts for other things? Where are they referenced?

Thanks once again,
-ik

I don't even remember when I learned about it... maybe when you study for MCSE? Or maybe when you just browse through all your files in C:\WINNT\SYSTEM32\ and try everything out.. heh?! :)
Actually, I think I used the equivalent program gpedit.exe (not sure if that is what it was called?) under NT4 to edit local policies...

Do a search on *.msc and you can see all of the other mmc addons.

It's "one of those things"...kind of like running 'gpupdate' when your domain account has been changed in AD, and you want to force the changes down to the local system. Or using "MSTSC /v:servername /console" to connect to a Terminal Server/Remote Desktop when all the remote sessions are in use...it's not well documented, but these things do show up in nooks and crannies around the 'net, and good tech's usually learn of them through various means and share them when the need arises, such as here. Go google 'gpedit admin help tips'...I bet you find a few sites that have lists of hints and tips. Googling for something you don't really know the name of can be somewhat difficult, even for the best of us.

On NT 4 it was called POLEDIT and it worked differently than the current gpedit snap-in. As the others mentioned, I learned about it eons ago and it was covered in the MCSE exam (at least when I took it).

Ahh well, back to business...

The Horse: Yepp, that's the one I was thinking of, POLEDIT, it was kinda the same, setting local policy settings. Was good at the time, to restrict access on "public" computers.. ! :)

Zencoder: Wow! Didn't know about mstsc /console! :)
That is very cool... hm... except for I can't get it to work.. ? (just connecting like a regular remote session) Guess I have to read up on how that is supposed to work... unless you can tell me real quick?! :)
(I'm trying from WinXP Pro to Win2000 and to Win2003 without success... ?)

I never knew about mstsc is thats jsut remote desktop?

mstsc /? will tell you everything you want to know.

For a quick and dirty:

mstsc /v 10.10.10.10:3389 /console

Where 10.10.10.10 is your TS.

You can also set security policy by using the secpol.msc snapin.

I didn't know that about the remote desktop. quite cool

Did you guys try the /console option for mstsc!? Are you connecting to a Win2000/Win2003 TS?
That sure isn't working for me at least, I just get connected like a regular RDP connection, not taking over the actual console session... :(

Would be really cool if it worked though...!

Maaaan... I have now tried all combinations I can think of, without success.
From WinXP/Win2003 to Win2000/Win2003...
Was never able to connect to the console session... :(

Must be doing something wrong I guess... or some kind of policy is preventing me to connect to the console and automatically shots me over to a regular RDP session.. strange... !

Guess I will try the MS Forums... will let you know if I figure it out...

Good point "mstsc /console"!! ;)

Thx!

Sorry, I think I confused myself!! :]

The only sadness is it only works on Win2003 not on Win2000...

Anyway, what confused me was when looking in TSADMIN, it still shows the remote console session as a RDP session, and the local console session is still "usused", but when looking closer the RDP session took over ID 0, which always is the console..
I guess TSADMIN is also getting some what confused over the whole thing.. hehe!

Started Windows Update locally, connected remotely with two admin connections, then tried a third to simulate you being locked out, then tried the /console option and voila! Took over the local console with Windows Update running in the background, awesome! :)

Very cool, thanks a lot zencoder!!

Quote:

---

Originally posted here by SawPer
Sorry, I think I confused myself!! :]

The only sadness is it only works on Win2003 not on Win2000...

Anyway, what confused me was when looking in TSADMIN, it still shows the remote console session as a RDP session, and the local console session is still "usused", but when looking closer the RDP session took over ID 0, which always is the console..
I guess TSADMIN is also getting some what confused over the whole thing.. hehe!

Started Windows Update locally, connected remotely with two admin connections, then tried a third to simulate you being locked out, then tried the /console option and voila! Took over the local console with Windows Update running in the background, awesome! :)

Very cool, thanks a lot zencoder!!

---

I don't think it is actually getting confused, and I don't believe the intent was ever to do a 'shared desktop' (like PCAnywhere). Microsoft already has a tool to do this in Remote Assistance (which is pretty much the same code base as Remote Desktop/Terminal Server). The point of /console is more of a policy issue. IIRC, the default setting for Remote Desktop/TS connections is 2 remote connections max. This can be changed, but I've seen it do some flaky things when too many users are connecting remotely with a full desktop. The /console option let's a Remote administrator connect even when the max. connections has been reached, by giving him the reserved session for the local console.

You folks having trouble will have to read up on the mstsc /? info for how to use it, I don't recall the details, but I consult it myself everytime I need to use this. I don't use anything older than XP/2003 nowadays, simply due to the environment I work in, so I haven't tried it in any other combinations. But it sure beats resorting to a tool like Dameware or VNC, if you need to do something on the fly!

BTW, some of you guys, know how copy local policy from a PC to another one?

Thank you.

That's what Active Directory is for.. do you have your computers in a Domain environment?
You can set all the policies through Active Directory Users and Computers, and have them apply to whole OU's.

If not, I'm not sure if it can be done. In NT4 with POLEDIT you were able to export and import those settings from one workstation to another, but doesn't seem as easy here.
I think all the files keeping this configruation are using extension *.adm .
Might be able to copy those to another machine? Haven't ever tried it though.. somebody else might know??

Yes, I already have a domain and GPO at OU level working. I was wondering it could be usefull with thw users who have laptops. Now I've to configure de local policy by hand in each!! :(

Thank you!

Quote:

---

Originally posted here by DerekK
Yes, I already have a domain and GPO at OU level working. I was wondering it could be usefull with thw users who have laptops. Now I've to configure de local policy by hand in each!! :(

Thank you!

---

Why?!? Are they in a different OU? Are they not members of the domain at all? We have all systems (except some select servers) in the Domain(s) here at my clients site. There are many groups (OU, but I like the word group for some reason) for different purposes. We have a 'relaxed GPO' group, where only the most important restrictions are placed on the system/user, but most of the rest are lifted (such as ability to install software, stop services, etc.) "Relaxe GPO" is for the power users in IT, for example. We have a mobile users group, so they can have a few of the extra options that users may need when not connected to the network.

All the laptops are in the domain... but how they login when they are away from the network? (not connected at all)... We use local users for that and they are not under any GPO.

If you have Win2003 Server(s) and Win XP laptops then I would restrict the laptops to always have to use their domain accounts, and then change the Group Policy to allow for cached domain logons at:

Computer Configuration - Windows Settings - Security Settings - Local Policies - Security Options - Interactive logon: Number of previous logons to cache

This way, even when they are not connected to the domain, they can still "logon" to the domain in cached mode with its policies and rules! :)

Hope that solves your issue?

Yes! That's right, is what I was looking for, because in some machines you are allowed to login with domain user , but in another ones you're not, and I didn't know why....

Then, if in one GPO this "value" is not defined, can you login as many times as you want by default?

Thank you!

If the value is not defined, it leaves the default which is to store the previous 10 logons