Grey out/hide "Log on to:" domain selection (login screen)

[ramsay]

On our Windows XP computers, we have an option to "Log on to:" our domain or "this computer". We would like to grey out this option or hide it from the user (greying out or hiding the options button will do the same thing).

 

Any help appreciated.

 

Thanks

[srochford]

Pretty sure you can't do this without editing the GINA (and you really don't want to do that)

[john]

There was something on here in the past, a regedit if i remember correctly, telling you how to do it, but I cannot find it.....

[glennda]

Pretty sure you can't do this without editing the GINA (and you really don't want to do that)

 

I think the Gina is pretty much just the images and stuff. I seem to think i played with this at work about a year ago - ill see if i still have the stuff i used - although i never deployed it.

 

but personally i like the customised msgina

[FN-GM]

if you grey it out, what if you need to logon locally. Say if it wont communicate on the network.

[ramsay]

glennda, thanks I'm interested in hearing more.

 

> if you grey it out, what if you need to logon locally. Say if it wont communicate on the network.

 

That's not really a concern for us, we want no local users to be used. Either credentials will be cached or if we don't go down that route, we are happy to reinstall XP if necessary; it's fully automated. If the network card is toast we can test that with a Live CD.

[glennda]

I'm sorry i think it was something I must have played with at my last place and not here - doesn't seem to be anywhere i normally save stuff! I never actually implemented it here (or there!) so it might just be i have deleted it

 

Sorry

[rvdmast]

In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

create a DWORD called NoDomainUI and set it to 1.

 

Be aware though, once the NoDomainUI value is set Windows will always assume logon to the local computer.

You must enter user@domain or domain\user to log on to the domain.

 

Another option is to set a DWORD called ShowLogonOptions in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

and set the value to 1.

This hides the Domain box and the Log on using dial-up connection options, but users can still

show them by clicking the options button.

The AltDefaultDomainName and DefaultDomainName registry keys will still work and users

do NOT need to use user@domain or domain\user if a default domain is set.

Edited April 28, 2010 by rvdmast

[Michael]

It must be doable as in RM CC3 they've totally re-designed the logon window and you cannot select from Local or Domain. When there's no active connection only administrators can logon, other users can't.

 

To be honest I don't consider it a major problem as users cannot logon as anything but a local administrator, so they have to guess the password. I do grey out the 'Log on using dial-up connection':

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"RasDisable"="1"

[ramsay]

> The AltDefaultDomainName and DefaultDomainName registry keys will still work and users

> do NOT need to use user@domain or domain\user if a default domain is set

 

Thanks, I have tried this but when using "NoDomainUI", the DefaultDomainName gets removed. Even if I re-enter it, it disappears when I log out.

[srochford]

It must be doable as in RM CC3 they've totally re-designed the logon window and you cannot select from Local or Domain.

 

To be honest I don't consider it a major problem as users cannot logon as anything but a local administrator, so they have to guess the password. I do grey out the 'Log on using dial-up connection':

 

 

I've not used RM CC3 but I suspect they've just replaced the standard MSGina (the bit that handles accepting credentials). If you're a C programmer this isn't difficult to do but if you get it wrong then you won't be able to log on at all so it's something to be careful with!

 

I'd guess it causes a problem because you get malicious users (in a school? Surely not!!) who change the login to the local machine and then the next user can't log in because they're not using the domain and they don't understand what they have to do. It's not a big deal but it can be a real irritation.

[rvdmast]

@ramsay: do not use NoDomainUI (option 1 ) if you use the ShowLogonOptions method (option 2)

Use either one or the other.

If you use the ShowLogonOptions method the AltDefaultDomainName and DefaultDomainName registry keys will still work.

[ramsay]

> Use either one or the other.

 

I'll have to consider another option then as NoDomainUI requires users to enter username@domain which is not ideal; my users can't cope with change, and ShowLogonOptions only collapses the options; it does not hide or grey them out.

 

I wonder if it is possible to remove the option log on to "(this computer)", leaving only the domain in the list, or ideally, grey this option out.

[ramsay]

I have successfully edited the msgina.dll file to hide the items I do not want. Would this be legal to implement?

[Trapper]

I have successfully edited the msgina.dll file to hide the items I do not want. Would this be legal to implement?

 

Probably not, as you've changed their code without permission. We once considered changing the GINA to show our school crest instead of the XP logo, but found out deploying it would breach the EULA.

[ramsay]

I've read the EULA but cannot find anything to do with modifying a file. A search for the words "modify, edit and change" do not bring up any relevant results.

[lolwut]

Sorry to bump an old thread....but I went to an educational institution that had replaced the banner of the classic login screen. I don't think they would do this if it was against the law.

Also, their is a thread on M$ technet about this, since it is M$ it must be heavily moderated, and it hasn't been deleted. I assume Microsoft do not care.

[Steve21]

I assume Microsoft do not care.

 

It depends what you mean by "banner". You can change the pic/background that's fine (Aligning logon pic etc by background), as it's not editting any code. Editting dll/gina's etc is breaking EULA So guess it depends which one you're referring to really.

 

Steve

[Hightower]

I know this thread is over a year old, but thought I would add my two cents for those stumbling on it. We are using pGina here for our logon needs. Can easily be tweaked (especially using Resource Hacker) to look like what our staff were used to when using CC3, and we're hopeful they'll not even see the difference when they come back in September.