Fix or disable XP Pro "logon to box" on 2003 Server network

[tazz]

Hi

 

Does anyone know of a way to fix the logon to box, on the CTRL, ALT + DEL screen so that is set to the domain name? I want to stop users loggin on to the local machine instead of the domain.

 

Thanks a lot!

 

Tazz

[wesleyw]

Quoted from a Mr Gary Middleton:

 

Although there is no group policy setting to do this, I got around the problem

 

by writing a custom ADM file which changes a couple of registry keys in:

 

HKLM\Software\Microsoft\WindowsNT\CurrentVersion\W inlogon.

 

 

 

The 2 keys to change are:

 

ShowLogonOptions - set to 0 to hide the domain list &

 

DefaultDomainList - set this to the domain you need to logon to.

 

 

 

Here's a copy of the ADM file:

 

;************************************************* ***************

 

;* Custom ADM file to force specific domain to logon to. You'll *

 

;* need to also change group policy \Computer\AdminTemplates\Sy *

 

;* stem\GroupPolicy\ Enable Registry Policy Processing, and *

 

;* enable "process even if the group policy objects have not *

 

;* changed" *

 

;* Written by Gary Middleton,UK *

 

;************************************************* ***************

 

 

 

 

 

 

 

CLASS MACHINE

 

 

 

CATEGORY !!Logon

 

 

 

POLICY !!HideDomainList

 

EXPLAIN !!HideDomainList_Help

 

KEYNAME "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

 

VALUENAME ShowLogonOptions

 

VALUEON NUMERIC 0 ; removes dropdown list

 

VALUEOFF NUMERIC 1 ; enables dropdown list

 

END POLICY

 

 

 

POLICY !!DefaultDomain

 

EXPLAIN !!DefaultDomain_Help

 

KEYNAME "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

 

VALUENAME DefaultDomainName

 

VALUEON "DOMAINNAME" ;where DOMAINNAME is the domain you want the

 

users to logon to

 

VALUEOFF ""

 

END POLICY

 

 

 

 

 

END CATEGORY

 

 

 

[strings]

 

Logon="Logon Options"

 

HideDomainList="Hide Domain List"

 

HideDomainList_Help="Enabling this settings hides the domain list from the

 

CTRL+ALT+DELETE screen.Disabling will show the domain list."

 

DefaultDomain="Default Domain"

 

DefaultDomain_Help="Default domain name to set to DOMAINNAME if enabled. It

 

will be the default option in the drop down list at the CTRL+ALT+DELETE

 

screen"

 

Just cut & paste into wordpad, save

 

with a .ADM extension. Load GPMC, right click administrative Tools &

 

add template, find location of the saved adm file.

 

To view change view\filtering from the menu with the policy loaded,

 

uncheck box "only show policy settings that can be fully managed"

 

You'll then be able to edit the 2 keys in your new Admin Template

 

within the policy.

 

 

Found at: http://www.mcse.ms/message973363.html

 

 

Wes

[ZeroHour]

nice solution wesleyw,

One thing to note is though unlike group policy, when you remove this adm the settings you set shall not revert unless you disable the various options and allow the changes to be rolled out.

E.G. if you set a reg key to 1 for the adm and then remove the adm, unlike group policy that reverts to 0 (otherwise known as the default option), the setting in the registry will stay marked as 1 until something changes it.