Avatar of mohave_steve
mohave_steve
 asked on

Windows 7 users receive "some settings are managed by your system administrator" when they try to change display settings.

Hello All,

I have deployed a couple of Win 7 desktops on my domain and need the end users to be able to change display settings without being local admins. They currently see the following menssage:

Some settings are managed by your system administrator.

I have checked the group policies and find all of the control panel and display entries "not configured". I understand that if the settings such as "hide display settings" are enabled that will prevent the user from changing settings. I have tried "not configured" and "disabled" and see no change in behavior.

Suggestions?

Thanks

Stephen
ComponentsWindows OSWindows 7

Avatar of undefined
Last Comment
mohave_steve

8/22/2022 - Mon
BCipollone

If you change their permissions to local admin are they able to make the changes?  If it is a group policy setting it should be restricted whether they are local admin or not.
madhatter5501

are the policies configured in the local security policy or local group policy?
mohave_steve

ASKER
BCipollone: Much to my suprise, making them local admin does not allow them to change.


madhatter5501: Domain Policy
I started with Experts Exchange in 2004 and it's been a mainstay of my professional computing life since. It helped me launch a career as a programmer / Oracle data analyst
William Peck
madhatter5501

I understand it is the domain policy you are looking at, but you say there is nothing configured so I would look under the local group policy on the workstation.  or, is this on more than one computer?
mohave_steve

ASKER
It is on two PC's deployed at the same time (OS cloned).
serverman2008

if they are on a domain, go under local administrator and then to local users and groups under computer management and  double click administrators under groups and make sure domain users and domain admins are added to that group.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
serverman2008

did you do a sysprep on both pc's cloned so they have different SID's?
mohave_steve

ASKER
serverman2008: Tried to check and almost lost a hand :) Apparently she has work to do :) I'll try again after quitting time.



serverman2008: Unjoined domain prior to colning. Then rejoined after cloning.
Run5k

It definitely sounds like an applied Group Policy, and based upon the fact that it appears on two machines that have been cloned, perhaps a local one.

You can use the Gpresult tool to find out exactly which Group Policies are configured when those users are logged into that machine:

http://technet.microsoft.com/en-us/library/bb490915.aspx

http://sourcedaddy.com/windows-7/using-gp-result.html

This is the best money I have ever spent. I cannot not tell you how many times these folks have saved my bacon. I learn so much from the contributors.
rwheeler23
Run5k

That being said, Serverman2008 is right:  you should definitely run Sysprep on those cloned machines before joining them to a domain.  Having two (or more) domain workstations online with the same SID can cause a myriad of problems.
mohave_steve

ASKER
Understood.
The were not joined to the domain when cloned. If memory serves me SID is applied when joining the domain.
serverman2008

regardless, always do a sysprep even if they were not joined to the domain at the time, save the hassle for future problems to arise :-)
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
mohave_steve

ASKER
Will do.
mohave_steve

ASKER
Logged into problem machine as domain administrator. I can change display settings.
I have checked local group policy under user/administrative/control/display and user/administrative/control/personalization and all entries show "not configured"
 
madhatter5501

sounds like they just don't have the correct permissions then like BCipollone mentioned

Local Users with admin rights:

User Configuration / Preferences / Control Panel Settings / Local Users and Groups
All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck
mohave_steve

ASKER
I have tried gpedit to look at policies as well as looking at non-administrator policies using mmc/group policy/non-adminstrair users.

All show not configured...


Next????
mohave_steve

ASKER
madhatter5501:

Not sure I understand your response.

I don't want to hve to make the users local admins in order to change display settings and I dont see: User Configuration / Preferences / Control Panel Settings / Local Users and Groups  in group policies. No Preferences under user configuration.
mohave_steve

ASKER
Tried "runas administrator" both by right clicking on desk.cpl and by using command line runas command and it continues to open restricted.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
mohave_steve

ASKER
Anyone?
Lucas Boyken

mohave_steve:  The message you are receiving is from a GP being applied (or a changed local policy) <-- most likely a GP as I see the same message appear when I lock down things on my domain via GPO.  Have you run the GPRESULT tool on the DC with the computer/username affected by the problem?  //lwb
mohave_steve

ASKER
lboykenee:

I have not. I have not used GPRESULT in that manner before.

Would the following be correct:

GPRESULT /S pc_name /U username RESULTFILE.HTM

??

Thanks

Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!
James Murphy
Run5k

Mohave_steve, two things come to mind:

1.  Is there a third-party application or control panel applet (like the ones from Nvidia or ATI) on this machine that might possibly be taking precedence over the default Windows interface or even preventing standard users from making changes to the settings?

2.  In order to be thorough, I would still utilize the Gpresult tool while the affected user is logged onto the machine.  Try the following command line syntax:

gpresult /h GroupPolicy.html

Once that is done, open the HTML file that was created by the gpresult output, configured it to "show all" near the top and scrutinize the group policies for anything that may potentially be causing this.
Lucas Boyken

Steve - did not see anywhere in the comments back and forth your Domain level, what OS your domain is running on the DC's, etc.  If you are running 2008 R2 Domain controllers you can run a GPResult interactively in the GPO utility (possibly in 2003 as well).  //lwb
mohave_steve

ASKER
lboykenee:

When run on the DC I receive the following:

RPC Server Unavailable.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.
Lucas Boyken

Group Policy Results Wizard in Group Policy Management:

GPM - Resultant Wizard
mohave_steve

ASKER
lboykenee:

PDC is SBS 2003
Lucas Boyken

Try the wizard in 2003:   GPM - Resultant Wizard - 2003
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes
mohave_steve

ASKER
I have run GPRESULT on the problem pc and run RSOP from the DC specifying the appropriate pc and user.

Nothing relating to display settings.
ASKER CERTIFIED SOLUTION
Run5k

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question
mohave_steve

ASKER
Run5k:

I think I will build a fresh image and put it on one of the machines at issue. I will makecertain that it is "plain vanilla" and see how it behaves.

mohave_steve

ASKER
It was either some control aplet that landed in the image or a corrupt image. Not sure which but creating a fresh image and applying to the machine resolved the issue.
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.