1

I have been struggling for days trying to resolve this issue. We are required to have our users press ctrl+alt+delete to login to our systems. The local security policy has the "Interactive logon: Do not require CTRL_ALT+DEL" policy set to enabled. If I set this to "Disabled", the either perform a login/logout or reboot/login, this polict reverts back to "Enabled". I have tried setting the registry key that also governs this: hklm\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCAD=0. Setting the key manually has same effect, it reverts back to 1 after reboot/relog. I enabled auditing of success/failure of the registry. The audit logs show that LogonUI.exe is modifying the DisableCAD key, I am assuming it is also the culprit resetting the local security policy. The audit logs also show another called FADisableCADOriginal being modified along with DisableCAD.

I have tried using secedit to reapply the base security policy using the defltbase.inf in %windir%\inf, but it had no affect (other than reset a lot of other policies I had modified and had to reset).

I found other people with this issue that solved it by uninstalling biometric fingerprint reader software. My systems have none of this software or devices.

My systems are not in a domain. No one I work with seems to know/remember if they had ever been in a domain before. I have read about something called GPO tattooing that can sometimes happen. Old domain GPOs can still be governing policies even after reoving a system from a domain.

Any thoughts as to why LogonUI.exe is mucking with this policy? As a side note, I am having sticking security policy issues with AutoAdminLogon as well. Registry value "AutoAdminLogon" under the winlogon key is being deleted after a reboot. This has been very frustrating. I really do not want to rebuild these three systems as a cure.

0

You must log in to answer this question.

Browse other questions tagged .