5

I need to create a bidirectional trust between two Active Directory domains. But management is worried that users will be puzzled out when seeing another domain name in the drop-down list in the Windows logon screen (many of them use Windows XP), and that help desk calls for failed logins due to having selected the wrong domain will skyrocket. Also, the two domain names are quite similar, adding to the possible user confusion.

Is there any way to hide a trusted domain from the drop-down list in the Windows logon screen?

1 Answer 1

7

The "Right" Way:

There is, yes (sort of), but before I tell you the way I know to do this, let me advise that the safer approach to this issue is to use group policy to force a default domain on the users - so by default, they log into the domain you dictate, and don't have to worry about the domain drop down list.


The "Disable the Domain List" way:

Anyhow, to remove the drop down list, which will force users to use the full UPN (user principal name):

  1. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  2. Create a new DWORD of NoDomainUI
  3. Set the value of this DWORD to 1
  4. Reboot the machine.

The logon screen will no longer show a drop-down list of domains when the machine boots up, and users will need to enter the full UPN to log on.

Obviously, as this is just a registry change, you can push it out by GPO or GPP to all your machines instead of doing it manually.


Using a Documented Bug to Hide All Domains but One:

EDIT: In response to @Massimo's comment with more explicit requirements, I found this Technet thread, which suggests the bug in this KB as a workaround.

Basically, as a result of the Netlogon.ftl file not having the proper permissions to be opened by the winlogon process, the list of trusted domains cannot be displayed, resulting in only the domain the machine/user belongs to being displayed.

Based on a quick test, this seems to work, in a 2003 FL forest, on an XP client (all virtualized in the lab environment on my laptop). I can't do more extensive testing at the moment, but would be really curious if someone else can and report whether it works for newer OSes or in different environments.

Using a bug like this has to be the hackiest thing I've ever done, and am morbidly curious to hear about how this fares in other environments.

5
  • Plus one on the more safer GPO option. Oct 4, 2012 at 8:11
  • Thanks for the tips, but both solutions are not adequate to this environment: the GPO setting you talk about only works from Vista onwards (which doesn't even have that drop-down list...), so would not solve the problem for XP clients; and forcing users to use their UPN instead of their user name would only confuse them even further.
    – Massimo
    Oct 4, 2012 at 8:40
  • @Massimo Check out the edit I made and see if using this bug as a workaround works for you... and do let me know, I'm really intrigued. Oct 4, 2012 at 9:07
  • Whoa... even if it worked, this is definitely something no sane sysadmin would ever use in a production environment (is such a thing as a sane sysadmin ever existed, of course).
    – Massimo
    Oct 4, 2012 at 9:21
  • @Massimo Like you said, not sane anyway. In your spot, I'd suggest this to management as a possibility I slaved long and hard to figure out (and look how brilliant I am, by the way, figuring out how to use a bug as a feature), and basically pass the buck on making a decision to them. (But be sure they recognize how brilliant and hard-working you are to have come up with this.) Both options suck... may as well make management earn their paychecks by deciding which suck to go with. :) Oct 5, 2012 at 9:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .