Administrator cannot unlock a locked machine on a domain

[Jaan]

Thread Zombie (sorry)

 

This helped me out today, can't this be deployed via gpo? if so whats the best way to do it?

 

i can figure out to reg entries.... but not the .DLLs

 

thanks

[sonofsanta]

I did it with Group Policy Preferences. 4 reg entries are done by GPP as well.

 

Group Policy Preferences > Windows Settings > Files > New File:

Action = Update

Source file: \\server\share\AdministrativeUnlock.dll

Destination file: %systemroot%\System32\AdministrativeUnlock.dll

Attributes: all false

 

Has worked a treat for me.

[Jaan]

I did it with Group Policy Preferences. 4 reg entries are done by GPP as well.

 

Group Policy Preferences > Windows Settings > Files > New File:

Action = Update

Source file: \\server\share\AdministrativeUnlock.dll

Destination file: %systemroot%\System32\AdministrativeUnlock.dll

Attributes: all false

 

Has worked a treat for me.

 

Thanks a lot!

 

we have just started giving our staff windows 7 pcs (70 out there at the mo) another 70+ to go...... this became a problem and i thought i'd have to re-image or install it one at a time.......

 

just added it to the base image and i'll add your instructions to a gpo deployment tomorrow. thx

[Jaan]

Sorry to be a pain again SONOFSANTA.

 

I thought i knew how to send the reg settings via gpo....but it turns out i don't......

 

these are the settings i have that i assume need to be sent (im in a test enviro at the mo, thank god)

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{B986C180-0798-4DF5-A611-A1991AA890B9}]

@="AdministrativeUnlock"

 

[HKEY_CLASSES_ROOT\CLSID\{B986C180-0798-4DF5-A611-A1991AA890B9}]

@="AdministrativeUnlock"

 

[HKEY_CLASSES_ROOT\CLSID\{B986C180-0798-4DF5-A611-A1991AA890B9}\InprocServer32]

@="AdministrativeUnlock.dll"

"ThreadingModel"="Apartment"

 

and i think i need to enter each string here:

 

 

thanks for you help btw

[sonofsanta]

Hive HKLM, key path SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{B986C180-0798-4DF5-A611-A1991AA890B9}

 

Hive HKCR, key path CLSID\{B986C180-0798-4DF5-A611-A1991AA890B9}

 

Hive HKCR, key path CLSID\{B986C180-0798-4DF5-A611-A1991AA890B9}\InprocServer32

 

Hive HKCR, key path CLSID\{B986C180-0798-4DF5-A611-A1991AA890B9}\InprocServer32

[Jaan]

WOW thanks i didn't expect that amount of help..... i dont think you could of done it any better if you remoted in!

 

Thank you very very much, its people like you thank make EDUGEEK what it is, thx

[timbo343]

Apologies for digging this back up, we are looking to deploy this out to our Windows 10 workstations but things have changed a little since i posted the original post.

 

Staff are no longer members of the local admin group, therefore cannot unlock a machine as an error message displays saying "the user is not a member of the local administrators group".

 

Someone has managed to edit the DLL for this software as mentioned here https://social.technet.microsoft.com/Forums/windows/en-US/767d6d66-ed5f-4d59-b629-267f3ea1dcba/how-to-unlock-windows-7-enterprise-when-another-user-has-locked-the-screen?forum=w7itprosecurity on 10th Septemeber 2014 but they cannot remember how they did it, soooo...

 

im asking if anyone knows how to edit a DLL file so we can specify a group from our AD.

[thimon]

In Windows 10 if the user locks the machine someone else can still come along and log in. From what I've read is this what your question is in relation to? Sorry if not!

[Jaan]

I still use this in our windows 10 test environment, works fine and users aren't local admins

[timbo343]

In Windows 10 if the user locks the machine someone else can still come along and log in. From what I've read is this what your question is in relation to? Sorry if not!

 

The existing user would still be logged on which i dont want to happen.

 

I still use this in our windows 10 test environment, works fine and users aren't local admins

 

Hmmm?? I wonder how you've got it to work. Even on windows 7 users had to be part of the administrators group.

[Jaan]

The existing user would still be logged on which i dont want to happen.

 

 

 

Hmmm?? I wonder how you've got it to work. Even on windows 7 users had to be part of the administrators group.

 

Sorry to clarify, only admins can log other people out. Non admins are unable to to do this, they call us and we do a remote logout via screen share. sorry for the confusion.

[Jaan]

Do you have this enabled in Gpo?

 

------

 

Hold the Windows Key and press “R” to bring up the Run dialog box.

Type “gpedit.msc” then press “Enter“.

The Local Group Policy Editor appears. Expand the following:

Local Computer Policy

Computer Configuration

Administrative Templates

System

Logon

Open “Hide Entry Points for Fast User Switching“.

Select “Enabled” to turn Fast User Switching off. Set it to “Disable” to turn it on.

Windows Hide entry points for fast user switching

[timbo343]

Ive got Hide Entry Points for Fast User Switching set to ENABLED so fast user switching is turned off.

[Jaan]

Just testing Win10 1703 and this doesn't seem to work anymore......can anybody else confirm please? worked in an old pre 1703 test environment.

[rinzwind]

Another way is to just keep fast user switching enabled and automatically logoff inactive users with utility named autologoff . Number of simultanious sessions is limitrd that way.