Disabling Safe mode and Boot Menu

[IT_Man_Dan]

Morning all,

 

Recently some of our darling users have been trying to bypass various security measures (including impero) by booting the PC in safe mode with networking.

 

We have done some research and found that running a script on the machine to prevent access to safe mode or the boot menu works like a charm. The script looks like:

 

@echo OFF

bcdedit /set {bootmgr} displaybootmenu no

bcdedit /set {default} bootstatuspolicy ignoreallfailures

 

PAUSE

 

My question is, can I just add this to the logon script or is it best just run manually once per machine (or groups via impero)?

 

Thanks

[Norphy]

Don't run it as a login script as that will run in the user's security context and won't work. Run it as a startup script, that will then run as system and work fine.

 

You'll probably want to some logic in there to detect whether the script has already run or not as well. Off the top of my head something like:

 

if exist c:\bcded.txt goto end
bcdedit /set {bootmgr} displaybootmenu no > bcded.txt
bcdedit /set {default} bootstatuspolicy ignoreallfailures >> bcded.txt
echo all done >> c:\bcded.txt
:end

 

With that you'll capture the output from the bcdedit commands in a text file that you can examine should something go pear shaped.

Edited April 8, 2014 by Norphy

[Liam]

This is what I did to get around it. Worked a treat

[IT_Man_Dan]

Thanks guys, Did you run it on all workstations or just a selection?

 

I'm trying to think of occasions that I might actually need to access safe mode on a client but I can't see any obvious ones. I can just reimage clients that have an issue and no data is stored locally.

 

Regards

[fairm010]

I have ran this on all our domain joined clients especially PC's used by the kids! Any problems, it's re-imaged in 15 minutes.

[IT_Man_Dan]

Thanks, Just set it up to run via GPO :-) I'll set it to run on all domain clients.

[Liam]

It's easily reversed in the same way applied. But it's very rare I diagnose an issue these days. Allow Wds to do it all for me. I can have it done in 15 back on the domain in the correct ou. Good old prestaged devices