Link to home
Create AccountLog in
Avatar of mohave_steve

asked on

Windows 7 users receive "some settings are managed by your system administrator" when they try to change display settings.

Hello All,

I have deployed a couple of Win 7 desktops on my domain and need the end users to be able to change display settings without being local admins. They currently see the following menssage:

Some settings are managed by your system administrator.

I have checked the group policies and find all of the control panel and display entries "not configured". I understand that if the settings such as "hide display settings" are enabled that will prevent the user from changing settings. I have tried "not configured" and "disabled" and see no change in behavior.



Avatar of BCipollone
Flag of United States of America image

If you change their permissions to local admin are they able to make the changes?  If it is a group policy setting it should be restricted whether they are local admin or not.
are the policies configured in the local security policy or local group policy?
Avatar of mohave_steve


BCipollone: Much to my suprise, making them local admin does not allow them to change.

madhatter5501: Domain Policy
I understand it is the domain policy you are looking at, but you say there is nothing configured so I would look under the local group policy on the workstation.  or, is this on more than one computer?
It is on two PC's deployed at the same time (OS cloned).
if they are on a domain, go under local administrator and then to local users and groups under computer management and  double click administrators under groups and make sure domain users and domain admins are added to that group.
did you do a sysprep on both pc's cloned so they have different SID's?
serverman2008: Tried to check and almost lost a hand :) Apparently she has work to do :) I'll try again after quitting time.

serverman2008: Unjoined domain prior to colning. Then rejoined after cloning.
Avatar of Run5k
It definitely sounds like an applied Group Policy, and based upon the fact that it appears on two machines that have been cloned, perhaps a local one.

You can use the Gpresult tool to find out exactly which Group Policies are configured when those users are logged into that machine:

That being said, Serverman2008 is right:  you should definitely run Sysprep on those cloned machines before joining them to a domain.  Having two (or more) domain workstations online with the same SID can cause a myriad of problems.
The were not joined to the domain when cloned. If memory serves me SID is applied when joining the domain.
regardless, always do a sysprep even if they were not joined to the domain at the time, save the hassle for future problems to arise :-)
Will do.
Logged into problem machine as domain administrator. I can change display settings.
I have checked local group policy under user/administrative/control/display and user/administrative/control/personalization and all entries show "not configured"
sounds like they just don't have the correct permissions then like BCipollone mentioned

Local Users with admin rights:

User Configuration / Preferences / Control Panel Settings / Local Users and Groups
I have tried gpedit to look at policies as well as looking at non-administrator policies using mmc/group policy/non-adminstrair users.

All show not configured...


Not sure I understand your response.

I don't want to hve to make the users local admins in order to change display settings and I dont see: User Configuration / Preferences / Control Panel Settings / Local Users and Groups  in group policies. No Preferences under user configuration.
Tried "runas administrator" both by right clicking on desk.cpl and by using command line runas command and it continues to open restricted.
mohave_steve:  The message you are receiving is from a GP being applied (or a changed local policy) <-- most likely a GP as I see the same message appear when I lock down things on my domain via GPO.  Have you run the GPRESULT tool on the DC with the computer/username affected by the problem?  //lwb

I have not. I have not used GPRESULT in that manner before.

Would the following be correct:

GPRESULT /S pc_name /U username RESULTFILE.HTM



Mohave_steve, two things come to mind:

1.  Is there a third-party application or control panel applet (like the ones from Nvidia or ATI) on this machine that might possibly be taking precedence over the default Windows interface or even preventing standard users from making changes to the settings?

2.  In order to be thorough, I would still utilize the Gpresult tool while the affected user is logged onto the machine.  Try the following command line syntax:

gpresult /h GroupPolicy.html

Once that is done, open the HTML file that was created by the gpresult output, configured it to "show all" near the top and scrutinize the group policies for anything that may potentially be causing this.
Steve - did not see anywhere in the comments back and forth your Domain level, what OS your domain is running on the DC's, etc.  If you are running 2008 R2 Domain controllers you can run a GPResult interactively in the GPO utility (possibly in 2003 as well).  //lwb

When run on the DC I receive the following:

RPC Server Unavailable.
Group Policy Results Wizard in Group Policy Management:

User generated image

PDC is SBS 2003
Try the wizard in 2003:   User generated image
I have run GPRESULT on the problem pc and run RSOP from the DC specifying the appropriate pc and user.

Nothing relating to display settings.
Avatar of Run5k
Flag of United States of America image

Link to home
Create an account to see this answer
Signing up is free. No credit card required.
Create Account

I think I will build a fresh image and put it on one of the machines at issue. I will makecertain that it is "plain vanilla" and see how it behaves.

It was either some control aplet that landed in the image or a corrupt image. Not sure which but creating a fresh image and applying to the machine resolved the issue.