Windows 7 users receive "some settings are managed by your system administrator" when they try to change display settings.

If you change their permissions to local admin are they able to make the changes?  If it is a group policy setting it should be restricted whether they are local admin or not.

are the policies configured in the local security policy or local group policy?

BCipollone: Much to my suprise, making them local admin does not allow them to change.


madhatter5501: Domain Policy

I understand it is the domain policy you are looking at, but you say there is nothing configured so I would look under the local group policy on the workstation.  or, is this on more than one computer?

It is on two PC's deployed at the same time (OS cloned).

if they are on a domain, go under local administrator and then to local users and groups under computer management and  double click administrators under groups and make sure domain users and domain admins are added to that group.

did you do a sysprep on both pc's cloned so they have different SID's?

serverman2008: Tried to check and almost lost a hand :) Apparently she has work to do :) I'll try again after quitting time.



serverman2008: Unjoined domain prior to colning. Then rejoined after cloning.

It definitely sounds like an applied Group Policy, and based upon the fact that it appears on two machines that have been cloned, perhaps a local one.

You can use the Gpresult tool to find out exactly which Group Policies are configured when those users are logged into that machine:

http://technet.microsoft.com/en-us/library/bb490915.aspx

http://sourcedaddy.com/windows-7/using-gp-result.html

That being said, Serverman2008 is right:  you should definitely run Sysprep on those cloned machines before joining them to a domain.  Having two (or more) domain workstations online with the same SID can cause a myriad of problems.

Understood.
The were not joined to the domain when cloned. If memory serves me SID is applied when joining the domain.

regardless, always do a sysprep even if they were not joined to the domain at the time, save the hassle for future problems to arise :-)

Will do.

Logged into problem machine as domain administrator. I can change display settings.
I have checked local group policy under user/administrative/control/display and user/administrative/control/personalization and all entries show "not configured"
 

sounds like they just don't have the correct permissions then like BCipollone mentioned

Local Users with admin rights:

User Configuration / Preferences / Control Panel Settings / Local Users and Groups

I have tried gpedit to look at policies as well as looking at non-administrator policies using mmc/group policy/non-adminstrair users.

All show not configured...


Next????

madhatter5501:

Not sure I understand your response.

I don't want to hve to make the users local admins in order to change display settings and I dont see: User Configuration / Preferences / Control Panel Settings / Local Users and Groups  in group policies. No Preferences under user configuration.

Tried "runas administrator" both by right clicking on desk.cpl and by using command line runas command and it continues to open restricted.

Anyone?

mohave_steve:  The message you are receiving is from a GP being applied (or a changed local policy) <-- most likely a GP as I see the same message appear when I lock down things on my domain via GPO.  Have you run the GPRESULT tool on the DC with the computer/username affected by the problem?  //lwb

lboykenee:

I have not. I have not used GPRESULT in that manner before.

Would the following be correct:

GPRESULT /S pc_name /U username RESULTFILE.HTM

??

Thanks

Mohave_steve, two things come to mind:

1.  Is there a third-party application or control panel applet (like the ones from Nvidia or ATI) on this machine that might possibly be taking precedence over the default Windows interface or even preventing standard users from making changes to the settings?

2.  In order to be thorough, I would still utilize the Gpresult tool while the affected user is logged onto the machine.  Try the following command line syntax:

gpresult /h GroupPolicy.html

Once that is done, open the HTML file that was created by the gpresult output, configured it to "show all" near the top and scrutinize the group policies for anything that may potentially be causing this.

Steve - did not see anywhere in the comments back and forth your Domain level, what OS your domain is running on the DC's, etc.  If you are running 2008 R2 Domain controllers you can run a GPResult interactively in the GPO utility (possibly in 2003 as well).  //lwb

lboykenee:

When run on the DC I receive the following:

RPC Server Unavailable.

Group Policy Results Wizard in Group Policy Management:

lboykenee:

PDC is SBS 2003

Try the wizard in 2003:  

I have run GPRESULT on the problem pc and run RSOP from the DC specifying the appropriate pc and user.

Nothing relating to display settings.

Run5k:

I think I will build a fresh image and put it on one of the machines at issue. I will makecertain that it is "plain vanilla" and see how it behaves.

It was either some control aplet that landed in the image or a corrupt image. Not sure which but creating a fresh image and applying to the machine resolved the issue.