It is a win7 ultimate x64 machine. The machine was in a domain where it got those group policy settings. Now it has left the domain but it still receives the settings from the group policy. For example, the power options. I set a certain power option but soon it will be reset to another power option which is endorsed by the domain.
Is there a way to remove the settings?
Open Regedit.
Backup your registry.
Delete the "HKLM\Software\Policies\Microsoft" Key (looks like a folder).
Delete the "HKCU\Software\Policies\Microsoft" Key
Delete the "HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects" Key.
Delete the "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies" Key.
Exit the registry and restart.
Note: HKLM = HKEY_LOCAL_MACHINE & HKCU = HKEY_CURRENT_USER
Note 2: The registry is and can be a dangerous place.
Thanks for replying. To answer your question - yes it's physically removed from the domain and now joins a workgroup. I am using a local admin account to log in. And yes, domain settings still apply.
If it is physically off the domain, and you ARE using a local account to log on, and it still carries the group policy settings, not only would i be very surprised, but something is wrong.
Indeed. It's a stuck policy. Fortunately, there is a rather ingenious way to fix this problem. Unfortunately, it's not common knowledge. Hopefully this answer will get around to enough sysadmins to fix that.
By the way, this works on all versions of Windows.
This solution is dependent upon the machine-in-question being dis-joined from the domain. If it is NOT dis-joined from the domain via the OS, then this will NOT work.
After the machine is dis-joined from the DC (Domain Controller), login using the local (machine) administrator account.
Go to Start (open the Start menu) > Run (open the Run app), and type 'cmd' (without the quotes) and press Enter. [Or open the Start menu and then run the Command Prompt program.]
Type gpupdate /force /boot and press Enter.
Once it's complete, reboot. The old group policy is gone.
Basically, how this works is it (since it gets no policy when you run the command), it applies an empty policy, which effectively removes the stuck policy once and for all.
If you run into problems, run gpresult /H GPReport.html from a Command Prompt window. If you see the DC or evidence that it pulled a policy, separate your computer from the network that's running on the DC and plug the machine into a separate network.
No internet connection is required for this solution, but the link needs to be up, and it needs to have an IP address.
RD /S /Q "%WinDir%\System32\GroupPolicyUsers" && RD /S /Q "%WinDir%\System32\GroupPolicy" and just gpupdate after reboot. Note that for example in my work enviroment we pushed auto gpupdate at computer boot and all registry entires are remediated by SCCM essential settings. If You remove any important key from registry, it will be recreated. It all depend on how Your administrators hardened settings.
For info if you have this on a computer that has not been removed from the domain. Export the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Group Policy hive then delete it. reboot and your computer pulls down the latest version of GPO.
I have had a few instances where GPO's have been updated and a gpupdate /force tells me it has applied the policies successfully but upon closer inspection some of the new settings have not been applied.
Check this through 'rsop.msc' to see all the settings applied and what GPO they came from.
Remember editing the registry can be very dangerous. Take care!
The system was PHYSICALLY removed from the domain? Has it been removed via the OS yet? Basically, does the system know it's not on the domain? If you are still logging into an account that was used while it was on the domain, chances are it hasnt been removed from the domain. Group policy will apply if it is a domain account, regardless of physical connection to the network that the domain resides on. Try logging in as the local administrator and see if that alleviates the problem. If it does, you need to disjoin the machine from the domain through the computer name tab in the advanced system settings and stop using the domain level account to log in.
If it is physically off the domain, and you ARE using a local account to log on, and it still carries the group policy settings, not only would i be very surprised, but something is wrong.
The settings I wanted to remove were "security" based such as password complexity, etc and the registry keys listed here did nothing. I found my answer here: http://www.thewindowsclub.com/how-to-reset-windows-security-settings-to-its-defaults It was this command: http://www.thewindowsclub.com/how-to-reset-windows-security-settings-to-its-defaults
I dont like Paperlanter's answer, I know what he is getting at, but hes not saying it correctly
Was the machine dis-joined from the domain from the domain? Either via Active Directory or from the machine's System Properties/Computer Name dialog?
If not, the group policy will still apply. This is true whether you are using the local admin account or not.
I have seen this but on my domain. I have computers that I've moved out of OU's that still keep OU's GPO's. I've moved them back into the OU and removed the check from Enforce and Link Enable. This helped remove the policy. I have noticed if you delete the policy from GPM they will never go away. You have to do it by the right steps or re-image the computer to remove the policies.
Remove workstation from the domain. Go to C:\Windows\security\database and rename file edb.chk to edb.old. Run a gpupdate /force three times and restart workstation. When done reconnect to domain and test.
