up vote 2 down vote favorite
1
share [g+] share [fb]

Group policy prevents several configuration settings on my Windows 7 / Vista machines. Since my domain account is a member of the local Administrators group on these boxes, is there still a way to override them locally?

For instance, GP prevents changing the power management option "Turn off the display" (even changing it from cmd fails: POWERCFG -X -monitor-timeout-ac 60 => "An unexpected error condition has occurred. Unable to perform operation. You may not have permission to perform this operation.")

Even when logging on with a local account and not the domain account, it's not possible to change the setting anymore ..

Thanks, everyone, it was me who posted this question on superuser.com. I should already have clarified this in my original post: I've already convinced our sysadmin to change the GP setting accordingly, however there is a lengthy process attached to it and it will take a couple of months (!) until the change will be officially approved and applied. Until then, I need a workaround to prevent my display from turning off after 15 min for a series of presentations I'm going to give.

link|improve this question
Just bear in mind that the post in question describes how to hack the settings, which I feel certain will be a violation of the corporate policy. – John Gardeniers Dec 5 '09 at 8:35
Max, you might want to talk to some folks in your management chain - if your IT department needs MONTHS to get a change like this through, then they've got a problem. You might want to talk to your management about getting them some more help - it sounds like they must be bogged down and need it! – Michael Kohne Dec 7 '09 at 14:35
Max, do you work at MS? if so why would you post this kind of thing on here? – Chopper3 Sep 30 '10 at 12:21
feedback

migrated from superuser.com Dec 4 '09 at 6:23

This question came from our site for computer enthusiasts and power users.

5 Answers

up vote 9 down vote

There's both the designed behaviour intended by Microsoft and the cold, stark reality of the situation at play here.

The designed behaviour is that group policy trumps any locally-specified settings. That's typically very handy, and is generally The Right Thing(tm).

The stark reality, as pointed out by the link that Anders gives to a Mark Russinovich TechNet blog entry is that, so long as an untrusted user has local Administrator rights, the best intentions of the "Domain Admins" can be overridden because they gave an untrusted user rights to do so.

The Right Answer(tm) to your question is:

Change the scope of the offending group policy objects, either by moving the computer objects in question, moving the GPlink in question, or filtering the GPO application with security group membership or a WMI query.

My guess is that you don't have rights to do that, which means you're probably not supposed to be overriding tose settings. As such, your question will be met, by all of us sysadmins on Server Fault, with a bit of a frigid reception. Generally speaking, we (sysadmins) don't want you playing around w/ the settings that we've mandated on your computer.

The fact that your sysadmin gave you local Administrator rights means that you are physically capable of overriding the settings. There's no point in trying to hide that fact, since you're going to figure it out anyway. The least I can do is tell you not to do it because, annoying as the Group Policy settings might be, there's probably a reason why they're being set. I'd recommend you talk to your sysadmin about the settings. (The phrase "my Windows 7 / Vista machines" in your question is telling. I'm guessing that an accurate description of the computer is actually "the Windows 7 / Vista machines that my employer pays for and that I use". It's really better if you think about the computers the second way, rather than the first. Your "Windows 7 / Vista machines" should be at home, where you should control their options...)

link|improve this answer
feedback
up vote 1 down vote

As this is an end user issue it should not have been migrated out of SuperUser. However, as it's here now...

Group policies rule - by design. When a domain admin sets a policy it's because he/she wants that specific behaviour and doesn't want the user to alter it. This may be for corporate reasons or it may be simply because that admin is a dictator (we all are to some degree). Regardless, you're stuck with it. Group policies would be pretty useless if the user could just over-ride them.

link|improve this answer
1  
Your answer is not truthful. If the user is a local admin, they can over-ride the settings. It's not a good plan for them to do so, but pretending that they can't is a bad idea. – Michael Kohne Dec 7 '09 at 14:32
They can do so only by hacking, not by default. If we are going to consider hacking as a normal day to day user procedure ANYTHING is possible. – John Gardeniers Dec 7 '09 at 23:21
feedback
up vote 1 down vote

Domain policies override local policies always. You may have local admin access, and thereby be able to create a local account and override user policies, but you won't be able to do anything about computer policies short of disjoining your machine from the domain.

In other words, you may rule the world as a local admin, but it ain't much of a world.

link|improve this answer
feedback
up vote 1 down vote

When you are local admin, you rule the world.

Checkout [link removed] on Mark's great blog

link|improve this answer
2  
It is my understanding that this site is about system administration. As such it is completely inappropriate to advice users how to hack settings and circumvent the policies applied by those in authority. – John Gardeniers Dec 5 '09 at 8:38
1  
That's silly. The users are going to figure it out eventually. We should document it here so that everyone knows where they stand. Especially in cases like this where the problem is that the user has local admin privs. – Michael Kohne Dec 7 '09 at 14:34
It's far from silly, this site is for sysadmins, not hackers, if they're that good they can find this information without this site. You don't find safe-cracking instructions on bank or police sites do you. Editing out link. – Chopper3 Sep 30 '10 at 12:15
1  
Mark Russinovich works at Microsoft, and the link goes to technet, a Microsoft site! It is pointless to edit my answer, its the 2nd hit if you google "bypass group policy" The blog post is from 2005, so that info is out there, like it or not. No point in censoring. – Anders Oct 5 '10 at 1:34
feedback
up vote 0 down vote

This program will "override" the power saving and screensaver settings. It can either move the cursor or just sends messages to the OS that the mouse is moving without actually moving the cursor.

http://mousejiggler.codeplex.com/

link|improve this answer
feedback

Your Answer

 
or
required, but never shown