0

I have recently installed win 8.1 and joined the computer to a domain, our group policy defines that ctrl alt del is needed to login to a workstation. Unfortunately it doesn't work on this new workstation.

I run gpupdate /force to get the settings updated and then i can lock the machine to then be presented with the ctrl alt del prompt, but i lock it again straight away and the prompt has gone.

I have pulled the computer from the domain and set the flag manually, I have manually set the registry key to find it reset itself after a restart or during runtime, i have also created a new group policy and moved the computer to it's own OU to try and rectify the issue.

There are two other settings controlled by group policy: the ability to use bio-metrics and screensaver timeout is set to 15 minutes. Now both these policy settings adhere but ctrl alt del interactive login is intermittent.

The workstation in question was previously set up with a HDD but now it has an SSD, I doubt that would make a difference.

This has been driving me mad for the past fortnight, any input will be greatly appreciated.

EDIT 1

After watching the processes, it turns out LogonUI.exe is the process that changes the relevant registry key!!!!!!

  • Is it a laptop? Did you try with an external keyboard? Why are you using 8.1 instead of 10? I have a domain connected Windows 10 workstation and I can press any key to get to the login screen. I didn't check the domain policy, though: could you please let me know exactly where to look? – simlev Apr 27 '17 at 10:17
  • you misunderstand, i can press any key to get to login but i want to use ctrl alt del. – d4ndym1k3 Apr 27 '17 at 10:28
  • Thanks for the clarification. I now understand your problem is the policy that requires pressing CTRL+ALT+DEL not being enforced. – simlev Apr 27 '17 at 10:39
0

The DisableCAD DWORD parameter in the registry should not reset. Clearly your problem is that the value actually resets. There's something re-writing that entry. Check out your startup programs and your domain policy. Make sure the domain policy actually applies to logged users / current user.

  • My startup programs are minimal and things you would expect. Sophos AV, Smart Audio CPL, java update, itunes helper, alps-pointing device driver. The value dosen't only reset at startup, but whilst on the desktop. As previously mentioned "I run gpupdate /force to get the settings updated and then i can lock the machine to then be presented with the ctrl alt del prompt, but i lock it again straight away and the prompt has gone." – d4ndym1k3 Apr 27 '17 at 10:33
  • Run RSOP "Resultant Set of Policy" Open RSoP as an MMC snap-in 1.Open Microsoft Management Console. 2.On the File menu, click Add/Remove Snap-in. 3.In the Available snap-ins box, click Resultant Set of Policy, and then click Add. 4.Click OK. You may have a conflicting policy. RSOP will let you see in detail – Dave M Apr 27 '17 at 10:48
  • Unfortunately that doesn't show any conflicts. we have two policies, one set up specifically for bio-metrics and the other is the default domain policy with interactive logon and screensaver timeout settings. – d4ndym1k3 Apr 27 '17 at 10:59
  • AV policy may overwrite that value. This must be checked. Also, is there another type of security software (related to internet access, document encryption or port control) ? – Overmind Apr 27 '17 at 11:52
  • 2
    Thank you @Overmind for your suggestion, it turned out that the sub-process was Thinkvantage fingerprint manager. Once uninstalling the software the issue has been resolved. – d4ndym1k3 Apr 28 '17 at 12:52

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.