Hi,
According to your description, my understanding of this issue is: You want
to use a GPO or change the registry keys to modify settings in Power
Management. If I have misunderstood your concern, please feel free to let
me know.
Based on my research, this can be done through a policy using the
powercfg.exe tool. This utility is introduced in Windows Server 2003
family. However, I have tested it on Windows XP SP2 and on 2000 sp3 and it
appeared to work fine.
Documentation for this tool can be found at
324347 How to Use Powercfg.exe in Windows Server 2003
http://support.microsoft.com/?id=324347
Here is how we created this policy:
1. Copy the powercfg.exe and the batch file to the netlogon share
Here is an example of a batch file
XXXXXXXXXXXXXXXXXXXXXXXXXXXXX
@echo off
net use x: \\domain.com\netlogon
x:
powercfg.exe /change "always on" /monitor-timeout-ac 0
powercfg.exe /SETACTIVE "always on"
c:
net use x: /delete
XXXXXXXXXXXXXXXXXXXXXXXXXXXX
2. Create a group policy that will be applied by the computer and the user
3. Add the path to the netlogon share and the batch file that you have
created as a logon script.
4. Go to the user rights section of the policy under the computer
configuration and give the users the right to "shut down the system".
5. Go the registry section under computer\windows settings\security
settings section of the policy and give the users full control to the
following keys. Please set this to propagate to the sub folders.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ControlsFolder\
PowerCfg
HKEY_CURRENT_USER\Control Panel\PowerCfg
Once the policy applies the setting will take effect the second time the
user logs in. The first time it will fail because the other rights and
permissions have not taken effect.
Now this gives the users the rights to change this setting which the
customer did not like even though it would get reset everytime they logged
on.
So as an additional part of the policy you can use the file system
permissions section to deny the users the right to the file
%systemroot\system32\powercfg.cpl. This will not let them open the Control
Panel extension to view or change the power settings even though they have
the actual power to change the settings.
If anything is unclear or you need further assistance on this issue, please
feel free to let me know.
You can refer to the examples as above. Hope this helps.
Best regards,
Vincent Xu
Microsoft Online Partner Support
======================================================
Get Secure! -
www.microsoft.com/security
======================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others
may learn and benefit from this issue.
======================================================
This posting is provided "AS IS" with no warranties,and confers no rights.
======================================================
--------------------
