Where are my rights???

[Guest]

Hi all,

I am supporting an educational lab of about 30 Dell Optiplexes (sp?) running
XP SP2. They log into a domain (Server 2003) all using the same username
(don't ask, I just got here). I have been trying to correct an issue where
after 15 minutes of being idle, the screensaver (Windows Logo) on the Dells
kicks in. When the instructor goes over to the machine to prep it for the
next class the pc is locked and he is prompted to log in again. On 30
machines this is very time consuming and annoying, especially when theres
only five minutes before the next class starts.
Here's where it gets ugly. According the the Local Users and Groups settings
this user account is a member of the local administrators. Yet this account
cannot change things like the screensaver. I am a domain admin and I added
myself to the local admin group and I can't do it either (along with some
other locked down policies).

I have gone into every part of the Domain policy and disbled the "prompt for
password after hibernate / standby" setting. Ive even done it on the local
policy. Ive also disabled the screensaver locally but it still comes up and
the machine is locked once again. Mind you, Im only able to make these local
changes using another local user account that I found on these machine. That
account is in Local Admins group too and is able to make changes.

If anyone thinks they can handle this situation with me, I would love to
hear from you. Unfortunaley, I am one of only thee tech people for the
district and the other two had nothing to do with the creation of the
policies or the AD (that person quit).

Thanks in advance!
Michael

 

[Guest]

Hi,
I have a place you can go to do some homework for your problem and I hope
it helps. you will have to do some research
at...http://www.microsoft.com/technet/support/default.mspx

or

you can try to disable and rename the Administrator Account by:

1) click the start button and select Run
2)Key in lusrmgr.msc and Click OK
3) When you have the Local User and Group Application on your screen, Just
right-click the Adiministrator entry and Select Rename. Give your
Administrator Account a new name such as ADMIN123.
4) Next, Disable the account by right-clicking the entry and selecting
properties
5) Check the Account Is Disabled Box
6) click ok to save changes
****NOTE ONLY WORKS ON XP PRO

OR

In Windows Xp you will have to go into regisrty editor and (hack) the screen
saver as the system default is 600 seconds (10 minutes).

OR

For Group Policy Editor>>> Start/ Run/ gpedit.msc /ok.............(XP PRO
ONLY)

I have just about every book on xp and several sources to look up
information if I can be of further assist, I will set this post to notify me
of further questions, All the answers are within reach its just a matter of
finding them. how ever my best suggestion would be to go to the 1st entry as
it can answer almost any question you may have. and there are alot of smart
people here so I can assume that someone may have a better suggestion. if the
1st link doesn't help.

 

[Steven L Umbach]

It sounds like screen saver is being enforced by a domain/OU Group Policy
that also applies to administrators. I would run rsop.msc on one of the
affected computers and look for settings under user
configuration/administrative templates/control panel/display to see if any
settings are enforced there and the Group Policy that applied the setting.
You would then have to modify the setting at that Group Policy or possibly
create another Group Policy that applies to the users that has contrary
settings that has a higher priority than the Group Policy that currently is
enforcing the settings. You may instead want to look at using winexit [from
the Resource Kit] as a logoff screen saver for your computers to force
logoff after a period of time rather than locking the computer. IMHO it is
also a bad idea to have those users be local administrators unless there is
a compelling reason that they need to be. --- Steve

 

[Guest]

Thanks so much for your help! I will give it a try and let you know how it
goes.

 

[Guest]

Steven,

Thank you very much for your suggestions. I will give them a try and see how
it goes.

Michael
--
May I have 10,000 marbles please?

It sounds like screen saver is being enforced by a domain/OU Group Policy
that also applies to administrators. I would run rsop.msc on one of the
affected computers and look for settings under user
configuration/administrative templates/control panel/display to see if any
settings are enforced there and the Group Policy that applied the setting.
You would then have to modify the setting at that Group Policy or possibly
create another Group Policy that applies to the users that has contrary
settings that has a higher priority than the Group Policy that currently is
enforcing the settings. You may instead want to look at using winexit [from
the Resource Kit] as a logoff screen saver for your computers to force
logoff after a period of time rather than locking the computer. IMHO it is
also a bad idea to have those users be local administrators unless there is
a compelling reason that they need to be. --- Steve

Hi all,

I am supporting an educational lab of about 30 Dell Optiplexes (sp?)
running
XP SP2. They log into a domain (Server 2003) all using the same username
(don't ask, I just got here). I have been trying to correct an issue where
after 15 minutes of being idle, the screensaver (Windows Logo) on the
Dells
kicks in. When the instructor goes over to the machine to prep it for the
next class the pc is locked and he is prompted to log in again. On 30
machines this is very time consuming and annoying, especially when theres
only five minutes before the next class starts.
Here's where it gets ugly. According the the Local Users and Groups
settings
this user account is a member of the local administrators. Yet this
account
cannot change things like the screensaver. I am a domain admin and I added
myself to the local admin group and I can't do it either (along with some
other locked down policies).

I have gone into every part of the Domain policy and disbled the "prompt
for
password after hibernate / standby" setting. Ive even done it on the local
policy. Ive also disabled the screensaver locally but it still comes up
and
the machine is locked once again. Mind you, Im only able to make these
local
changes using another local user account that I found on these machine.
That
account is in Local Admins group too and is able to make changes.

If anyone thinks they can handle this situation with me, I would love to
hear from you. Unfortunaley, I am one of only thee tech people for the
district and the other two had nothing to do with the creation of the
policies or the AD (that person quit).

Thanks in advance!
Michael