Grey out/hide "Log on to:" domain selection (login screen)

On our Windows XP computers, we have an option to "Log on to:" our domain or "this computer". We would like to grey out this option or hide it from the user (greying out or hiding the options button will do the same thing).

Any help appreciated.

Thanks

Pretty sure you can't do this without editing the GINA (and you really don't want to do that)

There was something on here in the past, a regedit if i remember correctly, telling you how to do it, but I cannot find it.....

Quote:

---

Originally Posted by srochford

Pretty sure you can't do this without editing the GINA (and you really don't want to do that)

---

I think the Gina is pretty much just the images and stuff. I seem to think i played with this at work about a year ago - ill see if i still have the stuff i used - although i never deployed it.

but personally i like the customised msgina

if you grey it out, what if you need to logon locally. Say if it wont communicate on the network.

glennda, thanks I'm interested in hearing more.

> if you grey it out, what if you need to logon locally. Say if it wont communicate on the network.

That's not really a concern for us, we want no local users to be used. Either credentials will be cached or if we don't go down that route, we are happy to reinstall XP if necessary; it's fully automated. If the network card is toast we can test that with a Live CD.

I'm sorry i think it was something I must have played with at my last place and not here - doesn't seem to be anywhere i normally save stuff! I never actually implemented it here (or there!) so it might just be i have deleted it

Sorry

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
create a DWORD called NoDomainUI and set it to 1.

Be aware though, once the NoDomainUI value is set Windows will always assume logon to the local computer.
You must enter user@domain or domain\user to log on to the domain.

Another option is to set a DWORD called ShowLogonOptions in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
and set the value to 1.
This hides the Domain box and the Log on using dial-up connection options, but users can still
show them by clicking the options button.
The AltDefaultDomainName and DefaultDomainName registry keys will still work and users
do NOT need to use user@domain or domain\user if a default domain is set.

It must be doable as in RM CC3 they've totally re-designed the logon window and you cannot select from Local or Domain. When there's no active connection only administrators can logon, other users can't.

To be honest I don't consider it a major problem as users cannot logon as anything but a local administrator, so they have to guess the password. I do grey out the 'Log on using dial-up connection':

Code:

---

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"RasDisable"="1"

---

> The AltDefaultDomainName and DefaultDomainName registry keys will still work and users
> do NOT need to use user@domain or domain\user if a default domain is set

Thanks, I have tried this but when using "NoDomainUI", the DefaultDomainName gets removed. Even if I re-enter it, it disappears when I log out.

Quote:

---

Originally Posted by Michael

It must be doable as in RM CC3 they've totally re-designed the logon window and you cannot select from Local or Domain.

To be honest I don't consider it a major problem as users cannot logon as anything but a local administrator, so they have to guess the password. I do grey out the 'Log on using dial-up connection':

---

I've not used RM CC3 but I suspect they've just replaced the standard MSGina (the bit that handles accepting credentials). If you're a C programmer this isn't difficult to do but if you get it wrong then you won't be able to log on at all so it's something to be careful with!

I'd guess it causes a problem because you get malicious users (in a school? Surely not!!) who change the login to the local machine and then the next user can't log in because they're not using the domain and they don't understand what they have to do. It's not a big deal but it can be a real irritation.

@ramsay: do not use NoDomainUI (option 1 ) if you use the ShowLogonOptions method (option 2)
Use either one or the other.
If you use the ShowLogonOptions method the AltDefaultDomainName and DefaultDomainName registry keys will still work.

> Use either one or the other.

I'll have to consider another option then as NoDomainUI requires users to enter username@domain which is not ideal; my users can't cope with change, and ShowLogonOptions only collapses the options; it does not hide or grey them out.

I wonder if it is possible to remove the option log on to "(this computer)", leaving only the domain in the list, or ideally, grey this option out.

I have successfully edited the msgina.dll file to hide the items I do not want. Would this be legal to implement?

Quote:

---

Originally Posted by ramsay

I have successfully edited the msgina.dll file to hide the items I do not want. Would this be legal to implement?

---

Probably not, as you've changed their code without permission. We once considered changing the GINA to show our school crest instead of the XP logo, but found out deploying it would breach the EULA.