Prevent 'Log-in via dial up connection'

[adamyoung]

Our kids have discovered 'log-in via dial up' option in the XP login box, how do we disable this, somewhere in GPO?

[ChrisH]

I think I have seen this before and the only way to get rid of it is to replace the msgina file which your not supposed to do.

On the machine add the following to the registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Create a new string RasDisable

1 = enable restriction

Restart and you should find its greyed out.

[IanB]

I don't think there is an option in GPO, but there is a registry key that governs the option box. if you copy the text below to a text file NoLogOnViaDialUp.reg and drop it into your netlogon share, you can run it on every workstation by startup script with the line-
regedit /s <server>\netlogon\NoLogOnViaDialUp.reg

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"RasDisable"="1"

[IanB]

Dang, you beat me to it.

[webman]

You could manually hack some of the .ADM templates to set this registry key but a .reg in the netlogon might be just as good.

[tarquel]

My custom adm didnt work last time [typical] as i was away ill and unable to test it myself - but hold fast... I'll try and give it another go.

Someone couldnt log on yesterday and it was because it was ticked hehe

So i'm keen to sort it to prevent the minor problem from happening again

Cheers
Nath

[andy]

How bizarre that I've never had that in the three years or so I've been here - until... yesterday

Andy

[tarquel]

lol the kids in the UK are talking it seems .....or watching this forum :S

I've half made a template - but although it loads into the GP Add/Remove templates bit, and I get the items appear, the actual "part"s of the policy dont appear.

I think it time for a graphical demo to explain what I'm going on about

[andy]

There are, IIRC, two types of policies (or more accurately: policies and something else) and you have to tell AD to show you both - I can't for the life of me remember where you select it - I had to do it myself when I started making ADMs. I will investigate further and report back (if noone says first!)

Andy.

[andy]

From the view menu - check "show policies only" is NOT ticked - that may sort it

Andy

[tarquel]

Yep - thats the one.

Except the route on 2003 GP is:

- Open a GPO
- select the Administrative Templates of either the Computer or User configuration
- choose the View menu and select Filtering...
- untick "Only show policy settings that can be fully managed

Voila - there it is on the right hand side now

I'll see if the policy works and post my little custom adm template for you all to drool over [or not as the case may be hehe]

Cheers
Nath

[Silvor]

Did you ever make an ADM file for this by any chance

[mpe]

Our kids have discovered 'log-in via dial up' option in the XP login box, how do we disable this, somewhere in GPO?

You need to ensure that the registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\RasDisable
exists and is set to a value of "1".

[ZeroHour]

One thing, you can easily do this with GPP which is a lot simpler then making an ADM.